A vulnerability has been found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This affects an unknown function of the…

A SQL injection vulnerability has been discovered in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0. The vulnerability affects the /SubstationWEBV2/main/elecMaxMinAvgValue file through manipulation of the fCircuitids parameter. The attack can be initiated remotely and the exploit has been publicly disclosed. The vendor was contacted about the disclosure but did not respond. This vulnerability poses a significant security risk as it allows remote attackers to potentially access or manipulate database information through SQL injection techniques.