This vulnerability affects Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0. The issue lies in the handling of the File argument in the /SubstationWEBV2/main/uploadH5Files function, which allows unrestricted file uploads. This can be exploited remotely without user interaction or privileges. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official fix or mitigation has been provided by the vendor, and the vulnerability state is published with public exploit information available.

Successful exploitation allows an attacker to upload arbitrary files to the affected system remotely. This could potentially lead to further compromise depending on the nature of the uploaded files and server configuration. However, the exact impact beyond unrestricted upload is not detailed in the available information. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, organizations should consider implementing compensating controls such as restricting access to the upload endpoint, validating and sanitizing uploaded files, and monitoring for suspicious upload activity until a vendor patch is released.