Unet Web Service
Monthly
Authenticated low-privileged attackers can upload arbitrary files to Acrel Electric's Unet Web Service (versions up to 20260814) via the /exchange/attachment/upload endpoint, potentially leading to remote code execution if uploaded files are stored in a web-accessible directory and executed. Publicly available exploit code exists, but valid credentials are required and no active exploitation has been confirmed (not in CISA KEV). This is a moderate-priority vulnerability with limited direct impact unless the unconfirmed RCE escalation condition is met.
Authenticated low-privileged attackers can upload arbitrary files to Acrel Electric's Unet Web Service (versions up to 20260814) via the /exchange/attachment/upload endpoint, potentially leading to remote code execution if uploaded files are stored in a web-accessible directory and executed. Publicly available exploit code exists, but valid credentials are required and no active exploitation has been confirmed (not in CISA KEV). This is a moderate-priority vulnerability with limited direct impact unless the unconfirmed RCE escalation condition is met.