{"id":"CVE-2023-47565","kind":"vulnerability","aliases":["CVE-2023-47565"],"related":[],"title":"qnap qvr firmware: An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x","description":"An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\n\nQVR Firmware 5.0.0 and later","summary":"QNAP VioStor NVR (network video recorder) has an OS command injection flaw that lets a logged-in user run arbitrary system commands over the network. CISA lists it as actively exploited in the wild.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2023-12-21T00:00:00+00:00","products":[{"name":"QNAP VioStor NVR","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qnap qvr firmware","fixed":["5.0.0"],"affected":">= 4.0.0, < 5.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","nvr","qnap","self-hosted","viostor"],"not_affected_if":["no-qnap-nvr","unauthenticated-only-exposure-blocked"],"how_to_check":null,"fix":"Apply the mitigation from the QNAP vendor advisory, or stop using the affected VioStor NVR until it is patched. Specific fixed firmware versions: unknown.","status":"open","published_at":"2023-12-08T16:15:16+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:38+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:02:38Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation from the QNAP vendor advisory, or stop using the affected VioStor NVR until it is patched. Specific fixed firmware versions: unknown.","reach":"network","impact":"high","summary":"QNAP VioStor NVR (network video recorder) has an OS command injection flaw that lets a logged-in user run arbitrary system commands over the network. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["qnap","nvr","viostor","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user runs arbitrary OS commands on the NVR device","analyst_note":"Find the QNAP security advisory for CVE-2023-47565 to get affected and fixed firmware versions and the exact mitigation; source lacks these.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-qnap-nvr","unauthenticated-only-exposure-blocked"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000473,"input_tokens":2808,"output_tokens":385,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':25A,28A '-47565':26A,29A '4':22A,97C '5.0.0':125C 'activ':74B 'affect':13A,88C 'allow':104C 'alreadi':115C 'arbitrari':64B 'authent':105C 'cisa':70B 'command':6A,53B,66B,81C,109C 'could':103C 'cve':24A,27A 'execut':108C 'exploit':36B,75B,100C 'firmwar':3A,21A,96C,124C 'firmware':35A 'fix':116C 'flaw':55B 'follow':121C 'found':11A,86C 'host':42B 'infrastructur':37B 'inject':7A,54B,82C 'later':127C 'legaci':14A,89C 'let':57B 'list':71B 'log':60B 'logged-in':59B 'model':18A,93C 'network':47B,69B,112C 'nvr':17A,32A,38B,46B,92C 'os':5A,52B,80C 'qnap':1A,15A,30A,33A,39B,44B,90C 'qvr':2A,20A,34A,95C,123C 'record':49B 'run':19A,63B,94C 'self':41B 'self-host':40B 'system':65B 'user':62B,106C 'version':122C 'via':110C 'video':48B 'viostor':16A,31A,43B,45B,91C 'vulner':8A,83C,102C,118C 'wild':78B 'x':23A,98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-12-08T16:15:16+00:00","kev":{"dateAdded":"2023-12-21","dueDate":"2024-01-11","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@qnapsecurity.com.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-47565","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47565","severity":null,"published_at":"2023-12-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-47565","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47565","severity":null,"published_at":"2023-12-08T16:15:16+00:00","modified_at":"2026-06-17T06:32:55+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}