CVE-2026-7696

MEDIUM

Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform uploadH5Files unrestricted upload

Title source: cna

Description

A vulnerability was found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This impacts an unknown function of the file /SubstationWEBV2/main/uploadH5Files. The manipulation of the argument File results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-360865 | Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform uploadH5Files unrestricted upload

https://vuldb.com/vuln/360865

Signature, Permissions Required signature permissions-required

VDB-360865 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/360865/cti

Third Party Advisory third-party-advisory

Submit #807944 | Acrel Electric Co., Ltd. EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 Unrestricted Upload of File with Dangerous Type

https://vuldb.com/submit/807944

Exploit exploit

https://ucn9h68n9289.feishu.cn/wiki/X9PAw4i5kiPueKkZqCCcNVYZnnc?from=from_copylink

Scores

CVSS v3 6.3

EPSS 0.0022

EPSS Percentile 12.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-284 CWE-434

Status published

Products (1)

Acrel Electrical/EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0

Published May 03, 2026

Tracked Since May 03, 2026