| 제목 | Acrel Electric Co., Ltd. Enterprise Microgrid Energy Efficiency Management System (ECEMS) 1.3.0 SQL Injection |
|---|
| 설명 | A critical unauthenticated SQL injection vulnerability was discovered in Acrel Electric Co., Ltd.'s Acrel Enterprise Microgrid Energy Efficiency Management System (ECEMS).
The vulnerability exists in the /SubstationWEBV2/main/elecMaxMinAvgValue endpoint, which is accessible to remote attackers without any prior authentication or user credentials. Due to a failure to effectively validate and filter user-controllable input, an attacker can transmit malicious SQL commands to the backend database.
Successful exploitation grants the attacker full unauthorized access to the database, allowing for the theft of sensitive energy infrastructure data, modification of system configurations, and potential disruption of microgrid operations. This poses a significant threat to critical infrastructure security. |
|---|
| 원천 | ⚠️ https://ucn9h68n9289.feishu.cn/wiki/WZMewApmsiT3PMkCJfzcASEznOb |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 04. 13. AM 04:41 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 05. 02. PM 09:38 (20 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 360863 [Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue SQL 주입] |
|---|
| 포인트들 | 20 |
|---|