CVE-2026-9523

HighCVSS 7.3

Published: 26/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

Vulnerability in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2 allows remote SQL injection via the sort parameter in /SubstationWEBV2/app/..;/calc/getCalcmeterDetailDayListTree. Exploit is publicly available.

Risk Assessment

An unauthenticated attacker can manipulate database queries, leading to sensitive data leakage or system compromise.

Recommendation

Contact the vendor for a patch or temporarily block access to the vulnerable file.

Other vulnerabilities in Acrel Electrical EEMS

CVE-2026-9550High
A path traversal vulnerability in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 allows remote manipulation of the path argument in /SubstationWEBV2/app/..;/main/upfile, leading to arbitrary file read. Exploit is publicly available.

Original NVD description (English source)

A vulnerability was detected in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2. Affected by this vulnerability is an unknown functionality of the file /SubstationWEBV2/app/..;/calc/getCalcmeterDetailDayListTree. Performing a manipulation of the argument sort results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.