| عنوان | Acrel Unet Web Service (Acrel Gateway Port) unknown Unrestricted Upload |
|---|
| الوصف | A vulnerability was identified in Acrel Unet Web Service (also known as
"Acrel Gateway Port"), a web-based IoT gateway management platform
developed by Acrel Electric Co., Ltd.
The /exchange/attachment/upload endpoint allows unauthenticated remote
attackers to upload arbitrary files without any file type validation or
access control. An attacker can upload malicious files (such as JSP
webshells) by sending a crafted multipart/form-data POST request. The
uploaded file path is returned in the response, potentially allowing
the attacker to access and execute the uploaded file, leading to remote
code execution and server compromise.
The system identifies itself as "Unet Web Service" in the HTML page
title and "Acrel Gateway Port" on the login page (configured via
config_prod.js TITLE field). It uses Vue.js + Element UI frontend with
"/exchange" as the API prefix.
No authentication is required to exploit this vulnerability.
The exact affected version is unknown as version information is not
exposed in the web interface.
Asset discovery search syntax:
1.FOFA: body="Unet Web Service" && body="Acrel Gateway Port"
2.Hunter: web.title:"Acrel Gateway Port"
3.360Quake: title:"Unet Web Service" |
|---|
| المصدر | ⚠️ https://github.com/WAz1nR9/CVE/blob/main/Acrel_Unet_Web_Service_PoC.md |
|---|
| المستخدم | WAz1nR9 (UID 96839) |
|---|
| ارسال | 14/08/2026 12:00 PM (2 أشهر منذ) |
|---|
| الاعتدال | 27/09/2026 07:41 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 410942 [Acrel Electric Unet Web Service حتى 20260814 Upload Endpoint upload ملف تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|