This vulnerability affects Acrel Electrical Prepaid Cloud Platform 1.0 and arises from an issue in the Backup File Handler component's processing of the /bin.rar file. The flaw allows remote attackers to cause information disclosure. The CVSS 4.0 vector indicates the attack requires no privileges, no user interaction, and has low impact on confidentiality. The vendor has not issued any patch or official remediation, and no cloud service is involved.

Successful exploitation can lead to unauthorized disclosure of information from the affected system. The impact is rated medium with a CVSS score of 6.9, reflecting that the vulnerability can be exploited remotely without authentication but results in limited confidentiality impact. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor for any updates from Acrel Electrical. Until a patch is available, consider restricting remote access to the affected component and monitor for suspicious activity related to the Backup File Handler. Avoid exposure of the vulnerable service to untrusted networks if possible.