CVE-2023-47565

CVE-2023-47565 is a high-severity (CVSS 8.0) vulnerability in QNAP VioStor NVR. CISA added it to the Known Exploited Vulnerabilities catalog on December 21, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by January 11, 2024. CISA does not currently list it as used in ransomware campaigns. QNAP has 11 vulnerabilities in the KEV catalog, 9 of them linked to ransomware.

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later

CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• https://www.qnap.com/en/security-advisory/qsa-23-48
• https://www.qnap.com/en/security-advisory/qsa-23-48
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47565