This vulnerability affects Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. An attacker can remotely exploit an SQL injection flaw by manipulating the fCircuitids parameter in a function located in /SubstationWEBV2/main/elecMaxMinAvgValue. The vulnerability allows injection of malicious SQL commands, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 6.9, indicating medium severity. No official fix or patch has been provided by the vendor, and the platform is not a cloud service, so remediation is the responsibility of the user.

Successful exploitation of this SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, data modification, or other database-related impacts. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should apply standard SQL injection mitigations such as input validation and parameterized queries if possible. Monitor vendor channels for any future advisories or patches. Since this is not a cloud service, remediation depends on the user environment. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.