This vulnerability is caused by the NAS device’s inadequate validation of filenames, enabling the traversal of directory boundaries. By supplying crafted filenames, an attacker can request the device to read files located outside the intended directory structure, potentially exposing configuration data and other sensitive system files. The primary consequence is a confidentiality breach that could leak privileged information.

The affected product is the HIKSEMI HS‑AFS‑S1H1 NAS. Version details are not disclosed, so any firmware version currently running on this device is considered at risk until the vendor issues a fix.

The CVSS base score of 4.6 classifies the issue as moderate severity. The EPSS score of less than 1% indicates that it is very unlikely to be exploited in the wild, and the vulnerability is not catalogued as a known exploited vulnerability by CISA. Nonetheless, the flaw enables an attacker with access to the NAS interface to read restricted files, so organizations should monitor logs for suspicious file access operations and apply a patch as soon as it becomes available. The attack vector is presumed local or internal, as the flaw requires interaction with the NAS’s file handling functionality.