This vulnerability in Acrel Electric Unet Web Service affects the upload endpoint at /exchange/attachment/upload. It allows remote attackers to perform unrestricted file uploads by manipulating the File argument. The vulnerability is present in versions up to 20260814. The vendor was contacted but did not respond, and no patch or mitigation has been published. The CVSS 4.0 score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability.

An attacker can remotely upload arbitrary files to the server via the vulnerable upload endpoint, potentially leading to unauthorized file storage or further exploitation depending on server configuration. The impact is rated medium with limited confidentiality, integrity, and availability effects. No confirmed active exploitation in the wild is reported.

No official fix or patch is currently available as the vendor has not responded. Users should monitor the vendor's channels for updates. Until a patch is released, restricting access to the upload endpoint, implementing file type validation, and applying network-level controls may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.