Is CVE-2022-29303 (SolarView Compact Command Injection) being exploited in the wild?

Yes. CISA added CVE-2022-29303 to its Known Exploited Vulnerabilities catalogue on 13 July 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product’s web server.

What the KEV listing means for this CVE

CISA’s KEV catalogue is the practical signal here. For CVE-2022-29303, the listing means there is credible evidence that attackers are exploiting SolarView Compact in real environments, so the question is no longer whether the flaw is theoretically dangerous but whether exposure still exists in your estate.

If you administer SolarView Compact, treat the product as an incident-priority asset until you have confirmed whether the vulnerable web console is deployed, reachable, and still running the affected code path. The most useful first question is not “is this CVE severe?” but “is this device exposed enough to be targeted, and is it already compensating or isolated?”

Zero-Day and Exploited Vulnerabilities Guide is the best starting point for the response pattern because KEV-listed issues require the same speed and discipline as other actively exploited vulnerabilities, even when the public write-up is brief.

How SolarView Compact command injection becomes operational risk

The vulnerability type matters because command injection can turn a web request into operating-system level execution. In practice, that means the attacker is not limited to changing a page or stealing a form value, they may be able to run commands on the device that sits behind the management interface.

That changes the exposure profile materially. A management console that was supposed to send a test email can become a foothold for device tampering, reconnaissance, credential theft, or pivoting into connected networks if the appliance is reachable and trusted by internal systems.

Web Application Attacks Guide provides the broader attack-pattern context for command injection, including why input handling failures on web consoles are often treated as code-execution risks rather than simple input bugs.

CISA Known Exploited Vulnerabilities Catalog is the authoritative place to verify the listing and remediation expectations before you decide whether compensating controls are enough for a short delay.

What to do if patching has to wait

When a KEV-listed flaw cannot be fixed immediately, the priority is to reduce reachability and remove the easiest exploitation path. For this kind of web-console injection, that usually means restricting network access to the management interface, limiting administrative exposure, and confirming that the device is not broadly reachable from user or guest networks.

It is also worth checking for signs that the console was used before remediation. Because command injection can execute arbitrary commands, look for unexpected processes, altered configuration, unusual outbound connections, or logs showing access to the send test mail function from unfamiliar sources or at odd times.

CVE Program is the right reference if you need canonical vulnerability identification, while NIST National Vulnerability Database is useful for cross-checking the record and tracking downstream references tied to the same identifier.

Risk and Threat Considerations

KEV inclusion means exploitation is not hypothetical, and command injection is one of the easiest ways for an attacker to convert a small web weakness into full device control. The real risk is not just the initial compromise, it is what that compromise enables on a system that may have network trust, monitoring blind spots, or privileged administrative access.

Failure mechanism: The product accepts unsafe input in the web server’s send test mail console, allowing crafted values to break intended command boundaries and reach system execution.

Impact: Attackers may gain unauthorized execution on the appliance, alter configuration, pivot into adjacent systems, or use the device as a persistence point if it remains exposed.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-12 — Network Infrastructure Management	Limits reachability of the exposed management interface.
	CIS-17 — Incident Response Management	Active exploitation requires incident handling, not only patching.
Recommendation — Restrict access to the SolarView management interface to approved administrative networks. Escalate suspected exploitation to incident response and preserve device evidence.
NIST SP 800-53 Rev 5	SC-7 — Boundary Protection	Controls exposure of the vulnerable web console across trust boundaries.
	SI-2 — Flaw Remediation	Actively exploited CVEs require prompt remediation tracking and validation.
Recommendation — Constrain SolarView access paths with boundary protections and segmentation. Remediate the vulnerable SolarView instance and verify the fix is in place.
OWASP ASVS	V4 — API and Web Service	The issue is a web-input handling flaw in a console endpoint.
Recommendation — Validate and constrain server-side inputs that reach web service commands.

Practitioner Guidance

What to verify: Confirm whether SolarView Compact is deployed anywhere, whether the web console is reachable outside tightly controlled admin paths, and whether the product instance is still within support and patch workflow. If you cannot answer those three questions quickly, treat that gap itself as exposure.

Decision rule: If the device is internet-reachable or reachable from broad internal segments, prioritise isolation or access restriction before waiting on a normal maintenance window; if you find evidence of suspicious activity around the console, escalate to compromise assessment rather than only patching.

Practitioner takeaway: For KEV-listed command injection, exposure control and compromise checks matter as much as the fix itself, because active exploitation means a vulnerable appliance should be handled like a likely intrusion path, not a routine vulnerability ticket.