The flaw exists in certain HIKSEMI HS-AFS-S1H1 NAS devices, where the access control mechanisms are inadequate for file resource operations. Authenticated users can modify or delete files belonging to other users, which can compromise the confidentiality, integrity, and availability of data stored on the device.

Affected devices are the HIKSEMI HS-AFS-S1H1 NAS series. No specific firmware version numbers are listed, so the vulnerability may be present across all current releases. Administrators should verify the firmware version currently in use and consult vendor advisories for patch information.

The CVSS score of 4.3 signals a moderate risk level, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not included in CISA's KEV catalog, yet it requires an attacker to have valid credentials, as the flaw is confined to authenticated users; based on the description, it is inferred that a compromised account is a prerequisite for exploitation.