CVE-2022-47767

Vulnerability

A backdoor exists in the slcore component of Solar-Log Gateway products, present in firmware versions v4.2.7 up to and including v5.1.1 [1]. This hidden functionality allows remote access via the web panel, bypassing authentication and granting super-administrator privileges. Devices running these firmware versions are affected, including the Solar-Log 50 Gateway, Solar-Log 250, 300, 1200, 1900, 2000, and Solar-Log Base. The SL 200, 500, and 1000 models are not affected [1].

Exploitation

An attacker with network access to the device’s web panel can exploit this vulnerability without any prior authentication or user interaction [1]. The attack vector is network-based, requires no privileges, and no special configuration beyond having an affected firmware version. The exact sequence of steps is not publicly detailed, but the backdoor provides direct entry to the administrative panel with full super-administrator rights [1].

Impact

Successful exploitation results in complete compromise of the device: the attacker gains super-administrator privileges, leading to full control over the gateway [1]. This can include reading sensitive data, modifying device configuration, and potentially using the device as a pivot for further network attacks. The CVSSv3.1 score is 9.8 (Critical) with confidentiality, integrity, and availability impacts all rated as High [1].

Mitigation

Solar-Log released fixed firmware versions for the affected models: version 4.2.8_117 (dated 30 May 2022) for Solar-Log 250, 300, 1200, 2000, and Solar-Log 50 Gateway; and version 5.1.2_157 (dated 6 July 2023) for Solar-Log Base devices [1][2]. A later version 6.0.x/6.1.x is also available for Base units [2]. Users should update immediately from the Solar-Log firmware download page. No workaround is documented; the only mitigation is applying the patched firmware [1].