DLL Hijacking Vulnerability in ABP and AES by Asustor

CVE-2025-13051

What is CVE-2025-13051?

A vulnerability exists in ABP and AES services that allows attackers to exploit a writable directory accessible to non-administrative users. By placing a malicious DLL with the same name as an existing service DLL in this directory, an attacker can execute unauthorized code with elevated system privileges. This occurs when the affected service is restarted, as the compromised DLL is loaded under the LocalSystem account, posing significant security risks.

References