| Title | Acrel Electric Co., Ltd. Enterprise Microgrid Energy Efficiency Management System (ECEMS) 1.3.0 SQL Injection |
|---|
| Description | A critical unauthenticated SQL injection vulnerability was discovered in Acrel Electric Co., Ltd.'s Acrel Enterprise Microgrid Energy Efficiency Management System (ECEMS).
The vulnerability exists in the /SubstationWEBV2/main/elecMaxMinAvgValue endpoint, which is accessible to remote attackers without any prior authentication or user credentials. Due to a failure to effectively validate and filter user-controllable input, an attacker can transmit malicious SQL commands to the backend database.
Successful exploitation grants the attacker full unauthorized access to the database, allowing for the theft of sensitive energy infrastructure data, modification of system configurations, and potential disruption of microgrid operations. This poses a significant threat to critical infrastructure security. |
|---|
| Source | ⚠️ https://ucn9h68n9289.feishu.cn/wiki/WZMewApmsiT3PMkCJfzcASEznOb |
|---|
| User | Anonymous User |
|---|
| Submission | 04/13/2026 04:41 (3 months ago) |
|---|
| Moderation | 05/02/2026 21:38 (20 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 360863 [Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue sql injection] |
|---|
| Points | 20 |
|---|