← CVE Radar
CVE-2023-47565Legacy VioStor NVR
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later
8.8 HIGHEPSS 73.27%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.8 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 8.0 | HIGH | 3.1qnap (CNA) | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Jan 11, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2023-47565
- Status
- Analyzed
- Assigner (CNA)
- qnap
- Published
- Dec 8, 2023
- Last modified
- 2026-06-17 06:32 UTC
- Weaknesses
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
As published by the CNA in the CVE record.
QNAP Systems Inc.VioStor NVR1 version range
- 4.x before 5.0.0