CVE-2024-40117
📋 TL;DR
This vulnerability allows attackers to bypass authentication and gain administrative privileges on Solar-Log 1000 devices by connecting to the web administration server. It affects Solar-Log 1000 devices running firmware versions before v2.8.2 and build 52-23.04.2013. Other Solar-Log models have different fixed versions as specified in the description.
💻 Affected Systems
- Solar-Log 1000
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Solar-Log device, allowing attackers to modify energy monitoring configurations, disrupt solar power operations, and potentially pivot to other network systems.
Likely Case
Unauthorized administrative access leading to manipulation of solar power monitoring data, configuration changes, and potential data exfiltration.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to the web administration interface.
🎯 Exploit Status
Public proof-of-concept code is available on GitHub, making exploitation straightforward for attackers with network access to the vulnerable device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.8.2 and build 52-23.04.2013 for Solar-Log 1000
Vendor Advisory: https://www.solar-log.com/en/support/firmware-database-1
Restart Required: Yes
Instructions:
1. Download the latest firmware from Solar-Log's firmware database. 2. Log into the Solar-Log web interface. 3. Navigate to the firmware update section. 4. Upload and apply the firmware update. 5. Reboot the device after update completion.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the Solar-Log web administration interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
VPN Access Only
allPlace the Solar-Log device behind a VPN and require VPN authentication for all administrative access.
🧯 If You Can't Patch
- Isolate the Solar-Log device on a separate VLAN with strict access controls
- Implement network monitoring and alerting for unauthorized access attempts to the web administration port
🔍 How to Verify
Check if Vulnerable:
Check the firmware version in the Solar-Log web interface under System Information. If version is before v2.8.2 or build 52-23.04.2013, the device is vulnerable.Check Version:
curl -s http://solar-log-ip/status.cgi | grep -i versionVerify Fix Applied:
After updating, verify the firmware version shows v2.8.2 or build 52-23.04.2013 or later in the System Information page.📡 Detection & Monitoring
Log Indicators:
- Unauthorized login attempts from unexpected IP addresses
- Administrative actions performed from non-admin user accounts
- Multiple failed login attempts followed by successful administrative access
Network Indicators:
- Unusual traffic patterns to the web administration port (typically 80/443)
- Connection attempts from external IP addresses to the Solar-Log device
SIEM Query:
source="solar-log" AND (event_type="admin_login" OR event_type="privilege_escalation") AND user!="admin"🔗 References
- https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2024-40117
- https://github.com/nepenthe0320/cve_poc/blob/master/Solar-Log%201000%20-%20Incorrect%20Access%20Control
- https://www.solar-log.com/en/support/firmware-database-1
- https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2024-40117
- https://github.com/nepenthe0320/cve_poc/blob/master/Solar-Log%201000%20-%20Incorrect%20Access%20Control
