CVE-2026-4536 - Vulnerability Details

- Acrel Environmental Monitoring Cloud Platform unrestricted upload

Description

A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0. This issue affects some unknown processing. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-03-22

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Acrist Environmental Monitoring Cloud Platform version 1.1.0 contains a flaw that allows an attacker to upload any file type without proper validation. The lack of access control and input filtering leads to unrestricted uploads, which could enable placement of malicious content on the server.

Affected Systems

The vulnerability affects the Acrel Environmental Monitoring Cloud Platform, specifically version 1.1.0. No other versions or related products are mentioned in the available data.

Risk and Exploitability

The CVSS base score of 6.9 indicates moderate severity, and the description notes the attack may be initiated remotely. Public proof‑of‑concept exploits have been released, raising the likelihood of real‑world attacks. EPSS data is not available and the vulnerability is not catalogued in the CISA KEV list. The unrestricted upload capability creates a risk that can be exploited without local access to the system.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Acrel

Environmental Monitoring Cloud Platform

affected

Version	Status	Constraints
`1.1.0`	affected	—

No data.

Vendor Product Confidence Versions

Acrel

Environmental Monitoring Cloud Platform

100%

Version	Status	Scheme	Platform
`1.1.0`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Restrict uploads to known file types and enforce approved extensions.
Store uploaded files outside any web‑accessible directories or configure the web server to treat them as data, not executable scripts.
Add authentication or authorization checks so only privileged users can upload content.
Validate file contents against expected signatures or MIME types to detect non‑conforming files.
Monitor upload logs for anomalous activity and implement rate limiting on the upload endpoint.
Contact Acrel for an official patch or advisory, and apply any vendor instructions once they become available.

Generated by OpenCVE AI on March 22, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.0005.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/LTX-GOD/Mycve/blob/main/Acrel_Co_Ltd.md
https://vuldb.com/?ctiid.352324
https://vuldb.com/?id.352324
https://vuldb.com/?submit.774423

History

Mon, 23 Mar 2026 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 23 Mar 2026 10:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Acrel Acrel environmental Monitoring Cloud Platform
Vendors & Products		Acrel Acrel environmental Monitoring Cloud Platform

Sun, 22 Mar 2026 04:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0. This issue affects some unknown processing. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title		Acrel Environmental Monitoring Cloud Platform unrestricted upload
Weaknesses		CWE-284 CWE-434
References		https://github.com/LTX-GOD/Mycve/blob/main/Acrel_Co_Ltd.md https://vuldb.com/?ctiid.352324 https://vuldb.com/?id.352324 https://vuldb.com/?submit.774423
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Acrel Environmental Monitoring Cloud Platform

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-03-22T04:02:11.372Z

Updated: 2026-03-23T15:36:30.479Z

Reserved: 2026-03-21T08:06:52.209Z

Link: CVE-2026-4536

Vulnrichment

Updated: 2026-03-23T15:36:26.368Z

NVD

Status : Awaiting Analysis

Published: 2026-03-22T05:16:19.850

Modified: 2026-03-23T14:31:37.267

Link: CVE-2026-4536

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-03-25T14:46:40Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object