This vulnerability affects Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. The flaw exists in the handling of the File argument in the /SubstationWEBV2/main/uploadH5Files function, which allows unrestricted file uploads. This can be triggered remotely without user interaction or privileges beyond low-level access. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official patch or remediation guidance has been provided by the vendor, who has not responded to disclosure attempts. Public exploit information is available, but no active exploitation has been confirmed.

Successful exploitation could allow an attacker to upload arbitrary files to the affected system remotely. This may lead to unauthorized file storage or potentially further compromise depending on the server's handling of uploaded files. The medium CVSS score reflects limited but notable risk due to the lack of authentication requirements and remote attack vector. However, the exact impact depends on the server environment and subsequent processing of uploaded files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, organizations should consider implementing temporary mitigations such as restricting access to the upload endpoint, applying web application firewall (WAF) rules to block suspicious upload attempts, and monitoring for unusual file uploads. Avoid exposing the vulnerable endpoint to untrusted networks if possible.