CVE-2026-18759 in ABP
Summary
by MITRE • 08/04/2026
The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the key and forge valid IPC requests. Furthermore, the service does not check the identity of the requesting process and validates destination paths using an insufficient substring check. A local attacker can submit crafted encrypted requests containing directory traversal sequences to perform arbitrary file reads and arbitrary file writes as NT AUTHORITY\SYSTEM, leading to full local privilege escalation. Affected products and versions include: ABP (ASUSTOR Backup Plan) 2.0.7.10171 and earlier as well as AES (ASUSTOR EZSync) 1.1.1.3113 and earlier.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability described represents a critical privilege escalation flaw in ASUSTOR's backup and synchronization services, specifically affecting ABP (ASUSTOR Backup Plan) and AES (ASUSTOR EZSync) products. These services operate with elevated privileges as NT AUTHORITY\SYSTEM, making them prime targets for local privilege escalation attacks. The underlying architecture relies on a file-based inter-process communication mechanism that employs AES encryption to secure communications between client processes and the background service. This design introduces several fundamental security weaknesses that collectively enable unauthorized users to gain system-level access.
The core technical flaw stems from improper key management and insufficient authentication mechanisms within the IPC system. The AES encryption keys are stored in files that are accessible to standard users, despite being protected through DPAPI (Data Protection API) which is designed for user-specific encryption rather than system-wide protection. This misconfiguration allows any authenticated local user to recover the encryption keys through standard file access methods or by leveraging DPAPI recovery techniques. The vulnerability extends beyond simple key recovery since the service implementation lacks proper process identity validation, meaning it accepts requests from any local process without verifying their legitimacy or origin.
The service's path validation mechanism represents another critical weakness that compounds the vulnerability. Instead of implementing robust path validation using absolute path checks or comprehensive input sanitization, the system relies on insufficient substring checking that can be easily bypassed through directory traversal sequences. This inadequate validation allows attackers to craft malicious IPC requests containing sequences like "../" that can traverse file system boundaries and access arbitrary files. The combination of recoverable encryption keys and weak path validation creates a complete attack vector where local users can forge valid IPC messages and execute arbitrary read/write operations as the SYSTEM account.
The operational impact of this vulnerability is severe, enabling full local privilege escalation from standard user to SYSTEM level access. Attackers can leverage this weakness to read sensitive system files, modify critical service components, inject malicious code into running processes, or manipulate backup configurations to exfiltrate data. The attack requires only local authentication and no special privileges beyond what a standard user would normally possess, making it particularly dangerous in environments where multiple users have access to the same systems. From an ATT&CK perspective, this vulnerability maps directly to privilege escalation techniques including 'Exploitation for Privilege Escalation' (T1068) and 'File and Directory Permissions Modification' (T1222), while also enabling potential lateral movement through system file manipulation.
Effective mitigations require multiple layers of defense to address both the key management issues and the path validation weaknesses. Organizations should immediately update to patched versions of ABP and AES software, as these vendors have likely released security patches addressing the root causes. System administrators should implement proper file access controls to restrict access to encryption key files and ensure that DPAPI-protected resources are properly secured at the system level. Additionally, service implementations must enforce robust process identity validation and implement comprehensive path validation using absolute path checking rather than substring matching. The solution aligns with CWE guidelines for secure coding practices, particularly addressing CWE-22 (Path Traversal) and CWE-310 (Cryptographic Issues). Network segmentation and monitoring should also be implemented to detect suspicious IPC activity patterns that may indicate exploitation attempts.