The ASUSTOR Backup Plan and ASUSTOR EZ Sync background services run as NT AUTHORITY\\SYSTEM and use a file‑based IPC mechanism encrypted with a key file that is readable by standard users. This flaw allows an authenticated local user to recover the encryption key, forge valid IPC requests, and send them to a process that does not verify the caller’s identity or properly validate destination paths. The service accepts crafted path strings that contain traversal sequences through a simple substring check, enabling the attacker to read or write any file on the system as SYSTEM. The ability to arbitrarily read and write files at SYSTEM level effectively grants full local privilege escalation. The weaknesses are identified as CWE-287: Improper Authentication and CWE-269: Improper Privilege Management.

Affected systems include ASUSTOR Inc. products ABP (ASUSTOR Backup Plan) version 2.0.7.10171 and earlier, and AES (ASUSTOR EZSync) version 1.1.1.3113 and earlier.

The CVSS score of 8.5 indicates a high severity vulnerability. Exploitation requires local, authenticated access; no remote attack vector is documented. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to be able to run code on the device as a local user to recover the key and craft malicious IPC requests, after which they can gain full SYSTEM privileges through arbitrary file access.