CVE-2023-47565highunder attackCWE-78

CVE-2023-47565: high-severity vulnerability in QNAP Systems Inc. VioStor NVR

Legacy VioStor NVR

Published · Updated

Follow this CVE+ Monitor VioStor NVR

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

73Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8epss 73%
from disclosure to weapon
Published on NVDDec 8
CISA KEV+13d
Action required by CISAfederal deadline: 2024-01-11

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A security flaw in QNAP VioStor NVR devices allows users who have logged in to run unauthorized commands on the system. This is dangerous because it can give attackers full control over the device and any data it stores.

Technical detail

OS command injection vulnerability in QNAP QVR Firmware 4.x affects legacy VioStor NVR models. Authenticated users can execute arbitrary OS commands via network, potentially achieving remote code execution and system compromise. Fixed in QVR Firmware 5.0.0 and later.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
QNAP Systems Inc. · VioStor NVR