An unauthenticated SQL injection vulnerability in Acrel Electrical ECEMS version 1.3.0 allows remote attackers to compromise the underlying database, creating significant operational and data integrity risks.

This is an SQL injection flaw, classified as CWE-89, occurring within the /SubstationWEBV2/main/elecMaxMinAvgValue file via the fCircuitids parameter. The attack vector is remote and requires no privileges or user interaction.

A successful exploit of this vulnerability could allow unauthorized individuals to read, modify, or delete sensitive data stored within the energy management database. This compromises system confidentiality, integrity, and availability, potentially disrupting microgrid monitoring operations. Given the CVSS score of 7.3, the risk profile is high, threatening both system stability and organizational trust.

Immediate Action: Restrict network access to the ECEMS interface and apply input validation filters to the vulnerable endpoint while awaiting an official vendor patch.

Proactive Monitoring: Monitor database query logs for anomalous or unauthorized SQL statements originating from the ECEMS application context.

Compensating Controls: Deploy a Web Application Firewall rule to inspect HTTP parameters and block requests containing SQL injection payloads targeting the elecMaxMinAvgValue endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as indicated by the referenced security advisory and exploit details.

This vulnerability presents a clear and pressing danger to energy management infrastructure due to its unauthenticated remote attack vector and the availability of a public proof-of-concept. Administrators should immediately isolate vulnerable systems from untrusted networks and implement strict boundary controls until the vendor provides a formal update.