Threat database

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. Affected by this issue is some unknown functionality of the file /SubstationWEBV2/app/..;/main/upfile. Executing a manipulation of the argument path can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2. Affected by this vulnerability is an unknown functionality of the file /SubstationWEBV2/app/..;/calc/getCalcmeterDetailDayListTree. Performing a manipulation of the argument sort results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-7696 is a medium severity vulnerability in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0. It involves an unrestricted file upload issue in the /SubstationWEBV2/main/uploadH5Files endpoint, allowing remote attackers to upload files without proper restrictions. The vendor has not responded to disclosure attempts, and no patch or official remediation is currently available. Exploit details have been made public, but there are no confirmed reports of exploitation in the wild.

A vulnerability has been found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This affects an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. The manipulation of the argument fCircuitids leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-7694 is a medium severity SQL injection vulnerability in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System version 1.3.0. The flaw exists in an unknown function within the /SubstationWEBV2/main/elecMaxMinAvgValue file, where manipulation of the fCircuitids argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Although an exploit has been published, there is no vendor response or patch available at this time.

CVE-2026-5601 is an information disclosure vulnerability in Acrel Electrical Prepaid Cloud Platform version 1.0. It involves improper processing of the /bin.rar file by the Backup File Handler component, which can be exploited remotely without authentication. The vulnerability has a medium severity score of 6.9 and an exploit has been publicly disclosed. The vendor has not responded or provided a fix. No official patch or remediation guidance is currently available.