ASUSTOR ABP and AES background services are susceptible to improper authentication and privilege management, enabling a local attacker to escalate privileges to NT AUTHORITY\SYSTEM.

The background services run with SYSTEM privileges and use a file-based inter-process communication mechanism that lacks proper authentication and privilege management (CWE-287, CWE-269), allowing a local user to interact with the service maliciously.

An attacker who has already gained low-level access to the system can leverage this vulnerability to achieve full administrative control over the host. This represents a critical risk to system integrity and confidentiality, justifying the high CVSS score of 8.5.

Immediate Action: Review the official ASUSTOR security advisory and apply the provided updates or configuration changes as soon as they become available.

Proactive Monitoring: Monitor for unexpected file modifications in the directories used for IPC and watch for processes spawning from the background services with elevated privileges.

Compensating Controls: Ensure the principle of least privilege is strictly enforced for all local user accounts to prevent initial access that could be used to trigger this flaw.

Public Exploit Available: Unknown.

This vulnerability presents a severe risk of local privilege escalation. Security teams must monitor the ASUSTOR security portal for patch releases and apply them to all affected installations of ABP and AES to prevent total system compromise.