An incorrectly set permission on the script ds-move-files.sh allows a local administrator to write and execute the file as root, creating a vulnerability that can be exploited to run arbitrary commands with system privileges. This represents a local privilege escalation flaw classified as CWE‑732. The impact is the compromise of the entire system’s security for the attacker.

The affected product is QNAP Systems Inc. Download Station. All releases prior to Download Station 5.10.1.312 and prior to Download Station 5.11.2.321 contain the vulnerability; the fix is incorporated in those versions and later releases.

The CVSS score of 8.4 indicates a high severity, while the EPSS score of less than 1% suggests a low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog, which further implies that no widespread exploit is publicly known. Exploitation requires physical or local access to a machine with an administrator account, and the attacker can elevate privileges to root, potentially bypassing all security controls on the device.