Attack Chain

1. The attacker identifies a vulnerable instance of Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2.
2. The attacker crafts a malicious HTTP GET or POST request targeting the /SubstationWEBV2/app/..;/calc/getCalcmeterDetailDayListTree endpoint.
3. The crafted request includes a manipulated sort parameter containing a SQL injection payload.
4. The application fails to properly sanitize the sort parameter, passing the malicious SQL code to the database.
5. The database executes the attacker-supplied SQL code.
6. The attacker retrieves sensitive information from the database, such as user credentials or system configurations.
7. The attacker may escalate privileges by injecting SQL code to create new administrative accounts.
8. The attacker gains full control of the application and underlying system, potentially leading to data exfiltration or service disruption.

Impact

Successful exploitation of this vulnerability can lead to a full compromise of the affected Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2. This can result in unauthorized access to sensitive data, including customer information, operational data, and system configurations. Attackers can modify or delete data, disrupt services, or use the compromised system as a launchpad for further attacks. The lack of vendor response exacerbates the risk, as users are left without official patches or mitigation guidance. The public availability of exploit code increases the likelihood of widespread attacks.

Recommendation

• Inspect web server logs for requests targeting /SubstationWEBV2/app/..;/calc/getCalcmeterDetailDayListTree with suspicious characters or SQL keywords in the sort parameter to detect potential exploitation attempts.
• Deploy the Sigma rule “Detect CVE-2026-9523 Exploitation Attempt via Malicious sort Parameter” to identify suspicious HTTP requests.
• Implement input validation and sanitization on the sort parameter to prevent SQL injection attacks.