Critical ASUSTOR Flaw (CVE-2025-13051) Allows Local DLL Hijacking for SYSTEM Privilege Escalation

ASUSTOR has issued a security advisory warning of a critical DLL hijacking vulnerability, tracked as CVE-2025-13051, that could allow local attackers to execute arbitrary code with SYSTEM-level privileges on Windows clients used with ASUSTOR’s backup and synchronization software. The flaw, rated CVSS 9.3, enables DLL planting in directories writable by low-privilege users and requires only local access to trigger privilege escalation.

ASUSTOR confirms the affected products are ASUSTOR Backup Plan (ABP) 2.0.7.9050 and earlier and ASUSTOR EZSync (AES) 1.0.6.8290 and earlier, with patched versions released as ABP 2.0.7.10171+ and AES 1.1.0.10312+.

The advisory states that when the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as one loaded by the service, and upon service restart the malicious DLL is loaded and executed under the LocalSystem account, according to the advisory. Published on 20 November 2025, the article notes the issue poses a serious risk to both enterprise and home users relying on ASUSTOR’s Windows software.