The vulnerability stems from incorrect default permissions in Synology Assistant, allowing any local user to read or write arbitrary files on the device. This leads to potential data confidentiality breaches and integrity violations, while also enabling denial-of-service during the installation process. The flaw is a direct consequence of misconfigured access controls, as identified by CWE-276.

Synology Assistant versions prior to 7.0.7-50095 are affected. Administrators should verify the current version of Synology Assistant and confirm whether an upgrade to at least 7.0.7-50095 has occurred.

The CVSS score of 7.3 classifies this flaw as high severity, though the EPSS score is not available and the vulnerability is not listed in CISA KEV. The attack vector is local; an attacker must have local user access to the device. No remote exploitation has been documented, and the vulnerability can be mitigated by applying the released patch. Given the local nature, the risk largely depends on the likelihood of local user compromise.