EUVD-2026-88288
GHSA-3367-rfr8-6gfx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryReach /exchange/attachment/upload endpoint
-
ExploitSubmit crafted File upload bypassing type checks
-
ExecutionStore malicious file in web-accessible path
-
PersistRequest uploaded payload
-
ImpactPotential code execution / data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged session (PR:L) on the Acrel Unet Web Service and network reachability to the Upload Endpoint at /exchange/attachment/upload; the attacker manipulates the File parameter to supply a file type the server fails to restrict. No user interaction is needed. Realistic impact escalates to RCE only if the target stores uploads in a web-accessible directory and the server executes the uploaded file type - an unconfirmed condition. Limiting factors: valid credentials are mandatory, and the instance must be reachable by the attacker (internet-exposed or same-network). |
| Impact | This is a moderate, not top-tier, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity flaw but requires authentication (PR:L), which meaningfully limits the attacker pool to those with valid accounts. The vendor scored all impacts as Low (VC:L/VI:L/VA:L → 5.3), but this is likely conservative: CWE-434 unrestricted file upload commonly enables webshell placement and remote code execution, which would justify High impact - the description does not confirm executable-file handling, so RCE is inferred, not established. Exploit maturity is E:P (proof-of-concept) and a public PoC exists on GitHub, but there is no EPSS score provided and no CISA KEV listing, so there is no evidence of active or automated exploitation. Net: publicly available exploit code plus a low-friction endpoint raises opportunistic risk for exposed instances, but the authentication requirement and niche product footprint keep real-world urgency moderate. Verify with the vendor whether uploaded files can be executed server-side, as that single fact determines whether true impact is Low (data-only) or Critical (RCE). |
| Exploit ScenarioDerived | An attacker with a low-privileged account on an internet-exposed Acrel Unet Web Service sends a crafted multipart POST to /exchange/attachment/upload, manipulating the File argument to upload a file whose type is not properly validated. If the uploaded file lands in a web-accessible path and is server-executable, the attacker requests it to obtain a webshell and code execution; a public PoC (GitHub WAz1nR9/CVE) demonstrates the upload. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Authenticated low-privileged attackers can upload arbitrary files to Acrel Electric's Unet Web Service (versions up to 20260814) via the /exchange/attachment/upload endpoint, potentially leading to remote code execution if uploaded files are stored in a web-accessible directory and executed. Publicly available exploit code exists, but valid credentials are required and no active exploitation has been confirmed (not in CISA KEV). This is a moderate-priority vulnerability with limited direct impact unless the unconfirmed RCE escalation condition is met.
RemediationAI
No vendor-released patch was identified at time of analysis; the vendor was contacted but did not respond. Apply compensating controls: restrict network access to the /exchange/attachment/upload endpoint to trusted IP ranges or disable the file upload feature entirely if not business-critical (trade-off: loss of functionality). Implement strict server-side file type validation using an allowlist of safe extensions and MIME types, and reject executable types such as .jsp, .php, .exe, etc. Store uploaded files outside the web root and ensure the upload directory has no execute permissions (requires configuration changes). Monitor server logs for anomalous uploads to that endpoint. Refer to VulDB (https://vuldb.com/vuln/410942) and the GitHub PoC (https://github.com/WAz1nR9/CVE/blob/main/Acrel_Unet_Web_Service_PoC.md) for technical details. If the endpoint is not needed, block it at the reverse proxy or WAF level.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an instance of CWE-434 (Unrestricted Upload of File with Dangerous Type) in the Upload Endpoint of Acrel Electric's Unet Web Service. The endpoint /exchange/attachment/upload accepts a File parameter without adequate validation of file type, extension, or content, allowing an authenticated attacker to upload files that the server may later execute. The affected product is identified by CPE cpe:2.3:a:acrel_electric:unet_web_service:*:*:*:*:*:*:*:* (all versions up to 20260814). According to the independent assessment, the attack requires a valid low-privileged session (PR:L) and network reachability to the endpoint; no user interaction is needed. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates limited confidentiality, integrity, and availability impact. Escalation to remote code execution is only plausible if the target stores uploads in a web-accessible directory and the server executes the uploaded file type, a condition that remains unconfirmed from available data. The vendor was contacted about the disclosure but did not respond.
Know when Unet Web Service gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Authenticated (PR:L) network upload with no user interaction; kept C/I/A at Low per available evidence since server-side execution/RCE is not confirmed by the description.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB