CVE-2026-18759

Name of the Vulnerable Software and Affected Versions ASUSTOR Backup Plan versions prior to 2.0.7.10172 ASUSTOR EZSync versions prior to 1.1.1.3114

Description The background service runs as NT AUTHORITYSYSTEM and uses a file-based inter-process communication (IPC) mechanism protected by AES encryption. Since the encryption key file is readable by standard users and protected by DPAPI (Data Protection API), an authenticated local user can recover the key to forge valid IPC requests. Additionally, the service fails to verify the identity of the requesting process and employs an insufficient substring check for destination paths. This allows a local attacker to send crafted encrypted requests using directory traversal sequences to perform arbitrary file reads and writes with NT AUTHORITYSYSTEM privileges, resulting in full local privilege escalation.

Recommendations Update ASUSTOR Backup Plan to a version later than 2.0.7.10171. Update ASUSTOR EZSync to a version later than 1.1.1.3113.