The vulnerability arises from improper authentication and insufficient validation in the ASUSTOR ABP and AES background services. The IPC mechanism relies on an AES encryption key stored in a file readable by standard users, protected only by DPAPI, which can be recovered by any authenticated local user. The service does not authenticate the requesting process identity and performs inadequate substring checks on file paths, allowing directory traversal attacks. Exploiting these flaws, a local attacker can craft encrypted IPC requests to read and write arbitrary files with SYSTEM privileges, achieving full local privilege escalation. The issue affects ABP versions up to 2.0.7.10171 and AES versions up to 1.1.1.3113. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM by forging IPC requests, enabling arbitrary file read and write operations with SYSTEM-level access. This can lead to full control over the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local user access to trusted users only and monitor for suspicious local activity related to ABP and AES services.