CVE-2025-13051 is a critical DLL hijacking vulnerability affecting ABP versions 2.0 through 2.0.7.9050 and AES versions 1.0 through 1.0.6.8290. An attacker with local access can replace a legitimate DLL in a non-administrative writable directory, leading to arbitrary code execution with LocalSystem privileges upon service restart. This vulnerability carries a CVSSv4 score of 9.3 (CRITICAL) due to its low attack complexity and high impact on confidentiality, integrity, and availability. Currently, there is no public exploit code available, and it shows no signs of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| ASUSTOR | ABP And AES | >= AES 1.0, <= 1.0.6.8290, >= ABP 2.0, <= 2.0.7.9050CNA affecteddefault unaffected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.8 Bluesky, 0.1 Mastodon, and 0.0 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.