CVE-2021-20661 – This directory traversal vulnerability in Solar... (How to Fix)

Q: What is the severity of CVE-2021-20661?

CVE-2021-20661 has a CVSS score of 8.1 (HIGH). This directory traversal vulnerability in SolarView Compact SV-CPT-MC310 allows authenticated attackers to delete arbitrary files and directories on the server. Attackers with valid credentials can potentially delete critical system files, configuration files, or application data. Only SolarView Compact SV-CPT-MC310 devices running versions prior to 6.5 are affected.

📋 TL;DR

This directory traversal vulnerability in SolarView Compact SV-CPT-MC310 allows authenticated attackers to delete arbitrary files and directories on the server. Attackers with valid credentials can potentially delete critical system files, configuration files, or application data. Only SolarView Compact SV-CPT-MC310 devices running versions prior to 6.5 are affected.

💻 Affected Systems

Products:

SolarView Compact SV-CPT-MC310

Versions: All versions prior to 6.5

Operating Systems: Embedded Linux (SolarView OS)

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated access to the SolarView web interface. The vulnerability exists in the web application component.

📦 What is this software?

Sv Cpt Mc310 Firmware by Contec

View all CVEs affecting Sv Cpt Mc310 Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise through deletion of critical system files leading to denial of service, data loss, or system instability requiring full reinstallation.

🟠

Likely Case

Unauthorized deletion of application files, configuration files, or user data leading to service disruption and potential data loss.

🟢

If Mitigated

Limited impact if proper access controls, file permissions, and monitoring are in place to detect and prevent unauthorized file operations.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires valid credentials but uses simple directory traversal techniques. The unspecified vectors suggest multiple potential exploitation paths.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 6.5

Vendor Advisory: https://www.contec.com/jp/-/media/contec/jp/support/security-info/contec_security_solarview_210216.pdf

Restart Required: Yes

Instructions:

1. Download SolarView Compact firmware version 6.5 or later from Contec's official website. 2. Backup current configuration and data. 3. Upload and install the firmware update through the web interface. 4. Restart the device. 5. Verify the update was successful.

🔧 Temporary Workarounds

Restrict Network Access

linux

Limit access to the SolarView web interface to trusted IP addresses only

iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP

Implement Strong Authentication

all

Enforce complex passwords and consider implementing multi-factor authentication if supported

🧯 If You Can't Patch

Implement strict network segmentation to isolate SolarView devices from untrusted networks
Implement file integrity monitoring to detect unauthorized file deletions

🔍 How to Verify

Check if Vulnerable:

Check the firmware version in the SolarView web interface under System Information or Settings. If version is below 6.5, the device is vulnerable.

Check Version:

Check via web interface at http(s)://[device-ip]/system_info or similar admin page

Verify Fix Applied:

After updating, verify the firmware version shows 6.5 or higher in the web interface. Test that directory traversal attempts are properly blocked.

📡 Detection & Monitoring

Log Indicators:

Unusual file deletion events in system logs
Multiple failed authentication attempts followed by successful login
Web server logs showing directory traversal patterns (../, ..\, etc.)

Network Indicators:

HTTP requests containing directory traversal sequences to SolarView endpoints
Unusual patterns of file deletion operations

SIEM Query:

source="solarview_logs" AND (event="file_deletion" OR uri="*../*")

📊 Metadata

CVE ID: CVE-2021-20661

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE: CWE-22

Published: February 24, 2021

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-20661, you might also want to check these: