CVE-2026-18759

An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.

Published Aug 4, 2026 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Description

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the key and forge valid IPC requests. Furthermore, the service does not check the identity of the requesting process and validates destination paths using an insufficient substring check. A local attacker can submit crafted encrypted requests containing directory traversal sequences to perform arbitrary file reads and arbitrary file writes as NT AUTHORITY\SYSTEM, leading to full local privilege escalation.
Affected products and versions include: ABP (ASUSTOR Backup Plan) 2.0.7.10171 and earlier as well as AES (ASUSTOR EZSync) 1.1.1.3113 and earlier.

Analysis

Technical impact

The ASUSTOR Backup Plan and ASUSTOR EZ Sync background services run as NT AUTHORITY\\SYSTEM and use a file‑based IPC mechanism encrypted with a key file that is readable by standard users. This flaw allows an authenticated local user to recover the encryption key, forge valid IPC requests, and send them to a process that does not verify the caller’s identity or properly validate destination paths. The service accepts crafted path strings that contain traversal sequences through a simple substring check, enabling the attacker to read or write any file on the system as SYSTEM. The ability to arbitrarily read and write files at SYSTEM level effectively grants full local privilege escalation. The weaknesses are identified as CWE-287: Improper Authentication and CWE-269: Improper Privilege Management.

Affected Systems

Affected systems include ASUSTOR Inc. products ABP (ASUSTOR Backup Plan) version 2.0.7.10171 and earlier, and AES (ASUSTOR EZSync) version 1.1.1.3113 and earlier.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity vulnerability. Exploitation requires local, authenticated access; no remote attack vector is documented. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to be able to run code on the device as a local user to recover the key and craft malicious IPC requests, after which they can gain full SYSTEM privileges through arbitrary file access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ASUSTOR Inc.

ABP

unaffected

Version	Status	Constraints
`ABP 2.0`	affected	≤ 2.0.7.10171

ASUSTOR Inc.

AES

unaffected

Version	Status	Constraints
`AES 1.0`	affected	≤ 1.1.1.3113

No data.

Vendor Product Versions

Asustor

Abp And Aes

Version	Status	Scheme	Platform
`[ABP 2.0,2.0.7.10171]`	affected	generic	['windows', 'x86', '64_bit']
`[AES 1.0,1.1.1.3113]`	affected	generic	['windows', 'x86', '64_bit']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade ABP to a version newer than 2.0.7.10171
Upgrade AES to a version newer than 1.1.1.3113
Configure the encryption key file so that it is readable only by NT AUTHORITY\\SYSTEM and untouchable system processes
If the background IPC service is not required, disable it to reduce the attack surface
Monitor system logs for suspicious IPC activity that indicates potential key recovery or unauthorized file operations

Generated by OpenCVE AI on August 4, 2026 at 20:06 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.171% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.asustor.com/security/security_advisory_detail?id=70

History

Aug 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Asustor Asustor abp And Aes
Vendors & Products		Asustor Asustor abp And Aes

Aug 4, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 4, 2026 9:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-269

Aug 4, 2026 7:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the key and forge valid IPC requests. Furthermore, the service does not check the identity of the requesting process and validates destination paths using an insufficient substring check. A local attacker can submit crafted encrypted requests containing directory traversal sequences to perform arbitrary file reads and arbitrary file writes as NT AUTHORITY\SYSTEM, leading to full local privilege escalation. Affected products and versions include: ABP (ASUSTOR Backup Plan) 2.0.7.10171 and earlier as well as AES (ASUSTOR EZSync) 1.1.1.3113 and earlier.
Title		An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.
Weaknesses		CWE-287
References		https://www.asustor.com/security/security_advisory_detail?id=70
Metrics		cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`