The software quietly managing electricity inside hospitals, factories, and office buildings around the world contains a flaw that could let a remote attacker take control of those systems — and the company that makes it has gone silent.
Who's at Risk — and Why It Matters
Acrel Electrical's ECEMS (Enterprise Microgrid Energy Efficiency Management System) is deployed in commercial and industrial facilities across multiple countries. These aren't just billing dashboards — they are live control and monitoring platforms that track, report, and in some configurations influence how electricity flows through a building or campus microgrid. Think hospitals maintaining critical power to ICUs, manufacturing plants running continuous production lines, and data centers managing cooling loads.
The vulnerability, tracked as CVE-2026-7694 and rated HIGH with a CVSS score of 7.3, affects version 1.3.0 of the platform. Because the attack requires no physical access and can be launched from anywhere on the internet, even a moderately skilled attacker halfway around the world could probe and exploit exposed installations. The exploit code has already been made public, which dramatically lowers the bar for who can attempt this.
What an Attacker Can Actually Do
Imagine the energy management console in your building's operations room — the screen showing live power consumption, circuit loads, and usage peaks. Behind that screen is a database storing years of electrical records and, critically, the configuration that tells the system what's normal and what should trigger an alarm. That database talks to the web interface through a series of requests. One of those requests asks the system: "Show me the maximum, minimum, and average electrical values for these specific circuits." The software is supposed to treat the circuit list as just a list. It doesn't.
Instead, a researcher discovered that the field accepting those circuit identifiers — essentially a simple text box in the web request — will blindly execute whatever instructions are passed into it, including instructions it was never meant to receive. An attacker can slip malicious database commands into that field, and the system will obediently run them. This technique, called SQL injection, is one of the oldest tricks in hacking — and the fact that it still appears in critical infrastructure software in 2025 is a damning indictment of the vendor's security practices.
Once inside the database, an attacker's options expand quickly. They can read sensitive configuration data, extract user credentials stored in the system, alter historical records to mask anomalies, or — in worst-case scenarios on systems where the database has elevated privileges — push commands to the underlying server itself. For a facility where electrical monitoring data feeds into automated responses, manipulating that data isn't just a privacy problem. It's a physical safety problem.
The Technical Detail Researchers Need to Know
The vulnerable endpoint is /SubstationWEBV2/main/elecMaxMinAvgValue, and the injectable parameter is fCircuitids. The vulnerability class is classic unsanitized SQL injection via a GET/POST parameter with no apparent input validation or parameterized query implementation. Given the endpoint's location within the SubstationWEB module, it sits squarely inside the operational data layer — not a peripheral reporting function. Security teams scanning exposed instances should prioritize this endpoint immediately in their WAF rule sets and network monitoring signatures.
Discovered, Disclosed — and Ignored
The vulnerability was responsibly disclosed to Acrel Electrical ahead of publication, following standard coordinated disclosure practice. The vendor did not respond. At all. No acknowledgment, no patch timeline, no out-of-band fix, no public advisory. That silence forced researchers to proceed with public disclosure — meaning the exploit details are now openly available on vulnerability tracking platforms before any official fix exists.
As of publication, there is no confirmed active exploitation in the wild, but that window is narrowing fast. Public exploit availability combined with an unpatched, internet-facing attack surface is precisely the recipe that ransomware groups and nation-state actors targeting industrial infrastructure have exploited repeatedly in recent years — from attacks on water treatment facilities to energy sector intrusions. The critical infrastructure sector has been a high-priority target for groups including Volt Typhoon and various ransomware operators throughout 2024 and into 2025.
What You Should Do Right Now
If your organization uses Acrel ECEMS, here are three concrete steps to take before a patch exists:
- Take the management interface off the public internet immediately. Version 1.3.0 of ECEMS should not be accessible from any IP address outside your organization's internal network. Place it behind a VPN and restrict access at the firewall level. If your vendor or integrator set this up with a public-facing URL "for convenience," that convenience is now a liability. Audit your network perimeter today — tools like Shodan can show you what you're accidentally exposing.
-
Deploy a Web Application Firewall rule blocking the vulnerable endpoint. If you run a WAF (and you should), create a rule that blocks or closely monitors all external traffic to the path
/SubstationWEBV2/main/elecMaxMinAvgValueand flags any requests where thefCircuitidsparameter contains SQL metacharacters such as single quotes, double dashes, semicolons, or UNION/SELECT keywords. This won't fix the vulnerability, but it raises the cost of exploitation significantly. -
Audit access logs for the past 90 days and escalate to your incident response team if anything looks unusual. Specifically look for unexpected or high-volume requests to the
elecMaxMinAvgValueendpoint, access from unfamiliar IP ranges, or database error messages appearing in application logs — these can be early signs of exploratory SQL injection attempts. If you don't have log retention going back 90 days, fix that policy now. Contact Acrel Electrical directly and demand a patch timeline in writing — and if they continue to ignore you, consider that a factor in your vendor risk assessment.
CVE: CVE-2026-7694 | CVSS: 7.3 (HIGH) | Affected Version: Acrel ECEMS 1.3.0 | Patch Available: No | Active Exploitation: Not confirmed as of publication