CVE-2026-5601 Details

A vulnerability allowing unauthorized information disclosure has been identified in Acrel Electrical Prepaid Cloud Platform version 1.0. This issue arises from unprotected backup files, specifically 'bin.rar', which is accessible without authentication. The exposed files contain sensitive configuration data, including intranet server IP addresses and database credentials, such as usernames and passwords. This information could be exploited to access backend business databases, manipulate key user data like payment records and account information, and potentially facilitate further attacks within the internal network.

Remove all exposed backup files from the web root directory and rotate any compromised database credentials. Implement access control measures to prevent public access to backup and configuration files, and conduct regular security audits to identify and eliminate exposed sensitive data. Establish secure deployment practices to avoid leaving backup files in production environments.