The vulnerability allows an attacker to inject arbitrary SQL through the fCircuitids argument in the /SubstationWEBV2/main/elecMaxMinAvgValue endpoint. This flaw falls under CWE-89 (SQL Injection) and can be triggered remotely, giving the attacker the ability to read, modify, or delete data in the underlying database. The impact includes potential data exfiltration, integrity compromise, and service disruption for users of the platform.

Acrel Electrical’s EEMS Enterprise Power Operation and Maintenance Cloud Platform, specifically version 1.3.0, is affected. No other affected versions are listed.

The CVSS score of 6.9 indicates a moderate severity. The exploit has been publicly disclosed and can be launched remotely, although the EPSS score is not available and the vulnerability is not on the CISA KEV list. Attackers could exploit it by sending crafted requests to the vulnerable endpoint, provided they can reach the target network. Due to the lack of mitigation from the vendor, the risk remains effective until a patch or workaround is applied.