The vulnerability originates from insufficient validation of input parameters on a management interface. Authenticated users can send specially crafted messages that cause the NAS to behave abnormally, potentially resulting in service interruption or degraded performance. This weakness allows an attacker who has already authenticated to manipulate the device’s operation, consistent with attributes of CWE‑233.

The affected product is the HIKSEMI NAS model HS‑AFS‑S1H1. No specific firmware or hardware revisions are listed, so any recent release may be vulnerable unless a patch has been issued by HIKSEMI.

With a CVSS score of 4.9 the vulnerability is rated moderately severe, but the EPSS score is below 1% and the issue is not listed in the KEV catalog, indicating a low probability of widespread exploitation. The attack requires valid credentials, so compromise may be limited to insiders or attackers who gain authenticated access. The potential impact is mainly service availability, as abnormal behavior can lead to restarts or loss of functionality.