| タイトル | Acrel Electric Co., Ltd. Enterprise Microgrid Energy Efficiency Management System (ECEMS) 1.3.0 SQL Injection |
|---|
| 説明 | A critical unauthenticated SQL injection vulnerability was discovered in Acrel Electric Co., Ltd.'s Acrel Enterprise Microgrid Energy Efficiency Management System (ECEMS).
The vulnerability exists in the /SubstationWEBV2/main/elecMaxMinAvgValue endpoint, which is accessible to remote attackers without any prior authentication or user credentials. Due to a failure to effectively validate and filter user-controllable input, an attacker can transmit malicious SQL commands to the backend database.
Successful exploitation grants the attacker full unauthorized access to the database, allowing for the theft of sensitive energy infrastructure data, modification of system configurations, and potential disruption of microgrid operations. This poses a significant threat to critical infrastructure security. |
|---|
| ソース | ⚠️ https://ucn9h68n9289.feishu.cn/wiki/WZMewApmsiT3PMkCJfzcASEznOb |
|---|
| ユーザー | Anonymous User |
|---|
| 送信 | 2026年04月13日 04:41 (2 月 ago) |
|---|
| モデレーション | 2026年05月02日 21:38 (20 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 360863 [Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue SQLインジェクション] |
|---|
| ポイント | 20 |
|---|