CVE-2023-47565: Legacy VioStor NVR
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We have already fixed the vulnerability in the following versions:
QVR Firmware 5.0.0 and later
Other sources
QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
QNAP VioStor NVRto a version that resolves this vulnerability.Fixed in 5.0.0 - Remove
Remove
QNAP VioStor NVRfrom your environment.Discontinue use of the product if mitigations are unavailable.
- Compensating control
Apply mitigations per vendor instructions.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-47565?
CVE-2023-47565 is classified as a high-severity OS command injection vulnerability affecting legacy QNAP VioStor NVR models.
Who is affected by CVE-2023-47565?
CVE-2023-47565 affects authenticated users of legacy QNAP VioStor NVR models running QVR Firmware 4.x.
How do I fix CVE-2023-47565?
To fix CVE-2023-47565, upgrade your QNAP VioStor NVR to QVR Firmware version 5.0.0 or later.
What type of vulnerability is CVE-2023-47565?
CVE-2023-47565 is an OS command injection vulnerability that can be exploited to execute commands over the network.
What can attackers do with CVE-2023-47565?
If exploited, CVE-2023-47565 allows attackers to execute arbitrary commands on affected QNAP VioStor NVR devices.