Hundreds of Internet-exposed devices inside solar farms remain unpatched against a critical and actively exploited vulnerability that makes it easy for remote attackers to disrupt operations or gain a foothold inside the facilities.

The devices, sold by Osaka, Japan-based Contec under the brand name SolarView, help people inside solar facilities monitor the amount of power they generate, store, and distribute. Contec says that roughly 30,000 power stations have introduced the devices, which come in various packages based on the size of the operation and the type of equipment it uses.

Searches on Shodan indicate that more than 600 of them are reachable on the open Internet. As problematic as that configuration is, researchers from security firm VulnCheck said Wednesday, more than two-thirds of them have yet to install an update that patches CVE-2022-29303, the tracking designation for a vulnerability with a severity rating of 9.8 out of 10. The flaw stems from the failure to neutralize potentially malicious elements included in user-supplied input, leading to remote attacks that execute malicious commands.

Security firm Palo Alto Networks said last month the flaw was under active exploit by an operator of Mirai, an open source botnet consisting of routers and other so-called Internet of Things devices. The compromise of these devices could cause facilities that use them to lose visibility into their operations, which could result in serious consequences depending on where the vulnerable devices are used.

“The fact that a number of these systems are Internet facing and that the public exploits have been available long enough to get rolled into a Mirai-variant is not a good situation,” VulnCheck researcher Jacob Baines wrote. “As always, organizations should be mindful of which systems appear in their public IP space and track public exploits for systems that they rely on.”

Baines said that the same devices vulnerable to CVE-2022-29303 were also vulnerable to CVE-2023-23333, a newer command-injection vulnerability that also has a severity rating of 9.8. Although there are no known reports of it being actively exploited, exploit code has been publicly available since February.

Incorrect descriptions for both vulnerabilities are one factor involved in the patch failures, Baines said. Both vulnerabilities indicate that SolarView versions 8.00 and 8.10 are patched against CVE-2022-29303 and CVE-2023-293333. In fact, the researcher said, only 8.10 is patched against the threats.

Palo Alto Networks said the exploit activity for CVE-2022-29303 is part of a broad campaign that exploited 22 vulnerabilities in a range of IoT devices in an attempt to spread a Marai variant. The attacks started in March and attempted to use the exploits to install a shell interface that allows devices to be controlled remotely. Once exploited, a device downloads and executes the bot clients that are written for various Linux architectures.

There are indications that the vulnerability was possibly being targeted even earlier. Exploit code has been available since May 2022. This video from the same month shows an attacker searching Shodan for a vulnerable SolarView system and then using the exploit against it.

While there are no indications that attackers are actively exploiting CVE-2023-23333, there are multiple exploits on GitHub.

There’s no guidance on the Contec website about either vulnerability and company representatives didn’t immediately respond to emailed questions. Any organization using one of the affected devices should update as soon as possible. Organizations should also check to see if their devices are exposed to the Internet and, if so, change their configurations to ensure the devices are reachable only on internal networks.