---
id: "CVE-2023-47565"
kind: "vulnerability"
aliases: ["CVE-2023-47565"]
title: "qnap qvr firmware: An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x"
severity: "high"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "QNAP VioStor NVR", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qnap qvr firmware", "fixed": ["5.0.0"], "affected": ">= 4.0.0, < 5.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "nvr", "qnap", "self-hosted", "viostor"]
not_affected_if: ["no-qnap-nvr", "unauthenticated-only-exposure-blocked"]
published_at: "2023-12-08T16:15:16+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47565", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47565", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# qnap qvr firmware: An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x

QNAP VioStor NVR (network video recorder) has an OS command injection flaw that lets a logged-in user run arbitrary system commands over the network. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:QNAP VioStor NVR affected ? fixed ?
- vendor:qnap qvr firmware affected >= 4.0.0, < 5.0.0 fixed 5.0.0

## Fix

Apply the mitigation from the QNAP vendor advisory, or stop using the affected VioStor NVR until it is patched. Specific fixed firmware versions: unknown.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47565
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-47565

## From the sources

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following versions:

QVR Firmware 5.0.0 and later

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_