This vulnerability (CVE-2024-0851) in Grup Arge Energy and Control Systems Smartpower is classified as CWE-89, indicating improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. It affects Smartpower versions through V24.05.27 and has a CVSS 4.0 base score of 10.0, reflecting critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and scope. The vulnerability allows an attacker to inject malicious SQL code, potentially compromising the backend database. No patch or official remediation level has been disclosed, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the affected Smartpower system's database. This can lead to unauthorized data disclosure, data modification, or disruption of service. Given the critical CVSS score and the nature of SQL Injection, the impact on confidentiality, integrity, and availability is high. No known exploits are reported in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected Smartpower instances and monitor for vendor updates. No vendor advisory or official remediation instructions are currently available.