EUVD-2026-31782
GHSA-cvjv-qpq8-hjx4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2. Affected by this vulnerability is an unknown functionality of the file /SubstationWEBV2/app/..;/calc/getCalcmeterDetailDayListTree. Performing a manipulation of the argument sort results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2 enables remote unauthenticated attackers to manipulate the sort parameter at the /SubstationWEBV2/app/..;/calc/getCalcmeterDetailDayListTree endpoint, achieving partial read, write, and availability impact against the backend database. The ..; path segment is a known Java servlet filter-bypass technique, suggesting the endpoint may circumvent URL-based access controls before reaching the vulnerable query handler. A public proof-of-concept exploit exists and the vendor did not respond to responsible disclosure, meaning no patch is currently available - leaving all deployments of this power infrastructure management platform exposed.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) describes the root cause: user-supplied input in the sort query parameter is concatenated into a database query without sanitization or parameterized binding. The affected CPE is cpe:2.3:a:acrel_electrical:eems_enterprise_power_operation_and_maintenance_cloud_platform:*:*:*:*:*:*:*:* - the wildcard version field confirms no specific fixed version is identified in NVD data. The URL structure /SubstationWEBV2/app/..;/calc/... is a well-documented path traversal bypass targeting Java EE servlet containers such as Apache Tomcat, where ..; causes the container to resolve the path differently than upstream security filters (e.g., Spring Security or a reverse proxy ACL), effectively exposing otherwise-restricted endpoints. The platform itself is an industrial energy management and power operations system, placing it in the operational technology (OT) / critical infrastructure category.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor did not respond to responsible disclosure, and no fixed version has been published. As a primary compensating control, restrict network access to the EEMS platform so it is not directly reachable from untrusted networks; placing it behind a VPN or network segment firewall reduces the AV:N attack surface to only authorized users, which is the most impactful single mitigation. Deploy a web application firewall (WAF) rule to detect and block SQL injection patterns on the /SubstationWEBV2/app/..;/calc/getCalcmeterDetailDayListTree endpoint specifically; note that WAF rules for the ..; bypass pattern may need to account for URL-encoding variants. If the affected endpoint is not required for operations, block it entirely at the reverse proxy or load balancer layer - disabling an unused endpoint eliminates the attack surface with no operational side effect. Monitor database query logs for anomalous ORDER BY clause patterns or UNION-based injection signatures. Track VulDB entry 365542 and the ENISA EUVD entry EUVD-2026-31782 for any future vendor patch release.
Unauthenticated path traversal in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0
SQL injection in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 allows remote una
Unrestricted file upload vulnerability in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platfor
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today