CVE-2026-101071: Acrel Electric Unet Auth Bypass Vulnerability

CVE-2026-101071 Overview

CVE-2026-101071 is an unrestricted file upload vulnerability in Acrel Electric Unet Web Service versions up to 20260814. The flaw resides in the /exchange/attachment/upload endpoint, where the File parameter accepts arbitrary content without proper validation. Attackers can exploit this issue remotely over the network with low-privilege authentication. The weakness is classified under [CWE-284: Improper Access Control]. A public proof-of-concept exists, and the vendor did not respond to disclosure attempts. The vulnerability affects the Upload Endpoint component of the application.

Critical Impact

Authenticated remote attackers can upload arbitrary files to the server through the attachment upload endpoint, potentially leading to persistent content on the host.

Affected Products

• Acrel Electric Unet Web Service (all versions up to and including 20260814)
• Upload Endpoint component (/exchange/attachment/upload)
• Deployments exposing the web service to untrusted networks

Discovery Timeline

• 2026-09-28 - CVE-2026-101071 published to NVD
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101071

Vulnerability Analysis

The vulnerability exists in the file upload handler at /exchange/attachment/upload. The endpoint processes the File argument without enforcing restrictions on file type, extension, content, or size. An authenticated attacker can submit crafted multipart requests containing arbitrary payloads. The impact scope covers confidentiality, integrity, and availability at a low level, consistent with limited file write primitives rather than full server takeover. Exploitation requires network access and low-privilege credentials, with no user interaction. The public proof-of-concept documents the request structure required to trigger the behavior.

Root Cause

The root cause is improper access control [CWE-284] on the attachment upload handler. The server fails to validate uploaded content against an allowlist of acceptable MIME types and extensions. Authorization checks on the endpoint do not sufficiently restrict what authenticated users can store on the server. Missing server-side validation on filename, content-type, and payload signatures permits unrestricted file placement.

Attack Vector

The attack vector is network-based. An attacker with valid low-privilege credentials sends a crafted HTTP POST request to /exchange/attachment/upload with the malicious payload bound to the File parameter. No user interaction is required. The vulnerability manifests when the server stores the uploaded content without filtering. Technical details and request structure are documented in the GitHub PoC Repository and VulDB CVE Details.

Detection Methods for CVE-2026-101071

Indicators of Compromise

• Unexpected files appearing in attachment storage directories associated with the Unet Web Service
• HTTP POST requests to /exchange/attachment/upload originating from unusual source addresses or non-standard user agents
• Files with executable or script extensions written to directories intended for document attachments

Detection Strategies

• Review web server access logs for high-volume or anomalous POST requests to the /exchange/attachment/upload path
• Hash and inventory files in attachment directories, flagging additions that do not match expected business document formats
• Correlate authentication events with upload activity to identify low-privilege accounts performing unusual upload volumes

Monitoring Recommendations

• Enable verbose logging on the Unet Web Service application layer, including request bodies and uploaded filenames
• Forward web and application logs to a centralized analytics platform for retention and correlation
• Alert on uploads whose Content-Type header does not match the declared file extension

How to Mitigate CVE-2026-101071

Immediate Actions Required

• Restrict network access to the Unet Web Service, limiting exposure to trusted management networks only
• Audit existing files in attachment storage directories and remove any unexpected or suspicious content
• Rotate credentials for low-privilege accounts that have access to the upload endpoint
• Monitor the vendor channel for a patch and apply it when released

Patch Information

No vendor patch is available at the time of publication. According to the CVE record, the vendor was contacted but did not respond. Organizations should track updates from Acrel Electric and apply any future fix for versions beyond 20260814. Refer to VulDB Vulnerability Details for ongoing status.

Workarounds

• Place the Unet Web Service behind a web application firewall configured to block uploads with executable extensions or script content
• Enforce reverse-proxy level filtering on requests to /exchange/attachment/upload, restricting allowed MIME types and maximum file size
• Disable or restrict the attachment upload functionality if it is not required for business operations
• Apply strict role-based access controls so only required accounts can authenticate to the upload endpoint

# Example nginx reverse-proxy restriction for the upload endpoint
location /exchange/attachment/upload {
    # Limit request body size
    client_max_body_size 2m;

    # Restrict to internal management network
    allow 10.0.0.0/8;
    deny all;

    # Block requests with executable content-types
    if ($content_type ~* "(application/x-(php|jsp|asp)|application/x-sh)") {
        return 403;
    }

    proxy_pass http://unet_backend;
}