| शीर्षक | Acrel Unet Web Service (Acrel Gateway Port) unknown Unrestricted Upload |
|---|
| विवरण | A vulnerability was identified in Acrel Unet Web Service (also known as
"Acrel Gateway Port"), a web-based IoT gateway management platform
developed by Acrel Electric Co., Ltd.
The /exchange/attachment/upload endpoint allows unauthenticated remote
attackers to upload arbitrary files without any file type validation or
access control. An attacker can upload malicious files (such as JSP
webshells) by sending a crafted multipart/form-data POST request. The
uploaded file path is returned in the response, potentially allowing
the attacker to access and execute the uploaded file, leading to remote
code execution and server compromise.
The system identifies itself as "Unet Web Service" in the HTML page
title and "Acrel Gateway Port" on the login page (configured via
config_prod.js TITLE field). It uses Vue.js + Element UI frontend with
"/exchange" as the API prefix.
No authentication is required to exploit this vulnerability.
The exact affected version is unknown as version information is not
exposed in the web interface.
Asset discovery search syntax:
1.FOFA: body="Unet Web Service" && body="Acrel Gateway Port"
2.Hunter: web.title:"Acrel Gateway Port"
3.360Quake: title:"Unet Web Service" |
|---|
| स्रोत | ⚠️ https://github.com/WAz1nR9/CVE/blob/main/Acrel_Unet_Web_Service_PoC.md |
|---|
| उपयोगकर्ता | WAz1nR9 (UID 96839) |
|---|
| सबमिशन | 14/08/2026 12:00 PM (2 महीनों पहले) |
|---|
| संयम | 27/09/2026 07:41 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 410942 [Acrel Electric Unet Web Service तक 20260814 Upload Endpoint upload Arquivo अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|