CVE-2026-4536

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4536", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-21T08:06:52.209Z", "datePublished": "2026-03-22T04:02:11.372Z", "dateUpdated": "2026-03-23T15:36:30.479Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-22T04:02:11.372Z"}, "title": "Acrel Environmental Monitoring Cloud Platform unrestricted upload", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-434", "lang": "en", "description": "Unrestricted Upload"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "Acrel", "product": "Environmental Monitoring Cloud Platform", "versions": [{"version": "1.1.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0. This issue affects some unknown processing. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-21T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-21T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-21T09:11:56.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "zsmaaa (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.352324", "name": "VDB-352324 | Acrel Environmental Monitoring Cloud Platform unrestricted upload", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.352324", "name": "VDB-352324 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.774423", "name": "Submit #774423 | Acrel Co., Ltd \u5b89\u79d1\u745e\u73af\u4fdd\u7528\u7535\u76d1\u7ba1\u4e91\u5e73\u53f0 1.1.0 Unauthorized File Upload Vulnerability", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LTX-GOD/Mycve/blob/main/Acrel_Co_Ltd.md", "tags": ["broken-link", "exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T15:36:22.854865Z", "id": "CVE-2026-4536", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:36:30.479Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Acrel Environmental Monitoring Cloud Platform unrestricted upload", "credits": [{"lang": "en", "type": "reporter", "value": "zsmaaa (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Acrel", "product": "Environmental Monitoring Cloud Platform", "versions": [{"status": "affected", "version": "1.1.0"}]}], "timeline": [{"lang": "en", "time": "2026-03-21T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-21T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-21T09:11:56.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.352324", "name": "VDB-352324 | Acrel Environmental Monitoring Cloud Platform unrestricted upload", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.352324", "name": "VDB-352324 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.774423", "name": "Submit #774423 | Acrel Co., Ltd \u5b89\u79d1\u745e\u73af\u4fdd\u7528\u7535\u76d1\u7ba1\u4e91\u5e73\u53f0 1.1.0 Unauthorized File Upload Vulnerability", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LTX-GOD/Mycve/blob/main/Acrel_Co_Ltd.md", "tags": ["broken-link", "exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0. This issue affects some unknown processing. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "Unrestricted Upload"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-22T04:02:11.372Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4536", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:36:22.854865Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-23T15:36:26.368Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-4536", "state": "PUBLISHED", "dateUpdated": "2026-03-22T04:02:11.372Z", "dateReserved": "2026-03-21T08:06:52.209Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-22T04:02:11.372Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Environmental Monitoring Cloud Platform", "vendor": "Acrel", "versions": [{"status": "affected", "version": "1.1.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0. This issue affects some unknown processing. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Acrel Environmental Monitoring Cloud Platform 1.1.0. Este problema afecta alg\u00fan procesamiento desconocido. Realizar una manipulaci\u00f3n resulta en una carga sin restricciones. El ataque puede ser iniciado remotamente. El exploit ha sido hecho p\u00fablico y podr\u00eda ser usado. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-4536", "lastModified": "2026-06-17T10:56:46.213", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4536", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T15:36:22.854865Z", "version": "2.0.3"}}]}, "published": "2026-03-22T05:16:19.850", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/LTX-GOD/Mycve/blob/main/Acrel_Co_Ltd.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.352324"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.352324"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.774423"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-434"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.1.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Environmental Monitoring Cloud Platform", "source": "cna", "vendor": "Acrel"}, "product": "environmental_monitoring_cloud_platform", "vendor": "acrel"}], "analysis": {"en": {"generated_at": "2026-03-22T06:20:33.686851+00:00", "value": {"mitigation_remediation": ["Restrict uploads to known file types and enforce approved extensions.", "Store uploaded files outside any web\u2011accessible directories or configure the web server to treat them as data, not executable scripts.", "Add authentication or authorization checks so only privileged users can upload content.", "Validate file contents against expected signatures or MIME types to detect non\u2011conforming files.", "Monitor upload logs for anomalous activity and implement rate limiting on the upload endpoint.", "Contact Acrel for an official patch or advisory, and apply any vendor instructions once they become available."], "summary": {"action": "Assess Impact", "impact": "Unrestricted File Upload"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Acrel Environmental Monitoring Cloud Platform, specifically version 1.1.0. No other versions or related products are mentioned in the available data.", "description_and_impact": "Acrist Environmental Monitoring Cloud Platform version 1.1.0 contains a flaw that allows an attacker to upload any file type without proper validation. The lack of access control and input filtering leads to unrestricted uploads, which could enable placement of malicious content on the server.", "risk_and_exploitability": "The CVSS base score of 6.9 indicates moderate severity, and the description notes the attack may be initiated remotely. Public proof\u2011of\u2011concept exploits have been released, raising the likelihood of real\u2011world attacks. EPSS data is not available and the vulnerability is not catalogued in the CISA KEV list. The unrestricted upload capability creates a risk that can be exploited without local access to the system."}}}}, "created": "2026-03-23T09:46:40.188265+00:00", "updated": "2026-03-25T14:46:40.126280+00:00", "vendors": ["acrel", "acrel$PRODUCT$environmental_monitoring_cloud_platform"]}