CVE-2026-7694: Acrel ECEMS SQL Injection Vulnerability

CVE-2026-7694 Overview

CVE-2026-7694 is a SQL injection vulnerability in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System version 1.3.0. The flaw resides in an unknown function within the /SubstationWEBV2/main/elecMaxMinAvgValue endpoint. Attackers can manipulate the fCircuitids argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable without authentication or user interaction. A public exploit has been disclosed, increasing the risk of opportunistic attacks. The vendor was contacted prior to public disclosure but did not respond. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact

Unauthenticated remote attackers can inject SQL statements through the fCircuitids parameter, potentially exposing or modifying microgrid energy management data.

Affected Products

• Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System 1.3.0
• Component: /SubstationWEBV2/main/elecMaxMinAvgValue endpoint
• Vulnerable parameter: fCircuitids

Discovery Timeline

• 2026-05-03 - CVE-2026-7694 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7694

Vulnerability Analysis

The vulnerability exists in the ECEMS web interface served at /SubstationWEBV2/main/elecMaxMinAvgValue. This endpoint accepts a fCircuitids parameter that is passed into a backend SQL query without proper sanitization or parameterization. Attackers supply crafted input to alter query semantics and execute arbitrary SQL against the underlying database.

The issue falls under [CWE-74], where untrusted input is incorporated into a downstream interpreter — in this case, the SQL engine. According to the EPSS data published on 2026-05-07, the probability of observed exploitation activity remains low at the time of disclosure, but a public exploit has been released.

Root Cause

The root cause is improper neutralization of special characters in the fCircuitids argument before its inclusion in a SQL query. The application concatenates user-controlled input directly into query strings instead of using prepared statements or parameter binding. This allows attackers to break out of the intended query context and append additional SQL clauses.

Attack Vector

Exploitation requires only network access to the ECEMS web interface. No authentication or user interaction is needed. An attacker sends an HTTP request to /SubstationWEBV2/main/elecMaxMinAvgValue with a malicious fCircuitids value containing SQL metacharacters such as single quotes, UNION SELECT clauses, or stacked queries. The backend executes the injected SQL, enabling data extraction, authentication bypass, or potentially modification of stored records depending on database privileges. The vulnerability mechanism is described in publicly available references; see the VulDB advisory for CVE-2026-7694 and the Feishu security writeup for technical details.

Detection Methods for CVE-2026-7694

Indicators of Compromise

• HTTP requests to /SubstationWEBV2/main/elecMaxMinAvgValue containing SQL metacharacters such as single quotes, --, UNION, or SELECT in the fCircuitids parameter.
• Database error messages or anomalous response sizes from the ECEMS application server following requests to the affected endpoint.
• Unexpected outbound database query patterns or unusual table access from the ECEMS service account.

Detection Strategies

• Deploy web application firewall (WAF) signatures that flag SQL injection patterns targeting the fCircuitids parameter on the /SubstationWEBV2/main/elecMaxMinAvgValue path.
• Enable verbose application and database query logging to identify malformed or suspicious queries originating from the ECEMS web tier.
• Correlate web access logs with database audit logs to detect time-aligned anomalies indicative of injection attempts.

Monitoring Recommendations

• Monitor HTTP request volume and parameter content for the affected endpoint, alerting on URL-encoded SQL keywords.
• Track failed and successful database queries containing UNION, INFORMATION_SCHEMA, or sleep-based payloads.
• Review network telemetry for repeated probing of the ECEMS host from a single source IP, which often precedes automated exploitation.

How to Mitigate CVE-2026-7694

Immediate Actions Required

• Restrict network access to the ECEMS web interface using firewall rules or VPN-only access until a vendor patch is available.
• Deploy WAF rules to block SQL injection payloads targeting the fCircuitids parameter on /SubstationWEBV2/main/elecMaxMinAvgValue.
• Audit database accounts used by the ECEMS application and apply least-privilege principles to limit damage from successful injection.

Patch Information

No vendor patch is available at the time of publication. According to the disclosure, the vendor was contacted early but did not respond. Organizations operating Acrel ECEMS 1.3.0 should monitor the VulDB entry for CVE-2026-7694 and Acrel vendor communications for remediation updates.

Workarounds

• Place the ECEMS application behind a reverse proxy with strict input validation that rejects requests containing SQL metacharacters in the fCircuitids parameter.
• Apply database-level controls such as read-only application accounts and stored procedure access patterns to reduce the impact of injected queries.
• Disable or block external access to /SubstationWEBV2/main/elecMaxMinAvgValue if the function is not required for operations.

# Example NGINX rule blocking SQL metacharacters in fCircuitids
location /SubstationWEBV2/main/elecMaxMinAvgValue {
    if ($arg_fCircuitids ~* "('|--|;|union|select|sleep|benchmark)") {
        return 403;
    }
    proxy_pass http://ecems_backend;
}