Technical impact
Insufficient validation of an input parameter on a network interface allows an authenticated user to send a crafted message that is executed as a command on the device. The flaw enables arbitrary command execution, effectively allowing an attacker to alter data, compromise confidentiality, or disrupt availability of the NAS system.
Affected Systems
HIKSEMI NAS devices, specifically the HS‑AFS‑S1H1 model are affected. No specific firmware or software versions are listed, so the issue is presumed to exist across all supported releases of the affected product family.
Risk and Exploitability
The vulnerability scores a 7.2 on the CVSS scale, indicating high severity, but the EPSS score is below 1%, suggesting a low likelihood of current exploitation. It has not been listed in the CISA KEV catalogue. Exploitation requires authentication to the device and the ability to send specially crafted interface messages, allowing an attacker with those privileges to achieve full device compromise.
