CVE-2023-47565

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following versions:

QVR Firmware 5.0.0 and later

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	VioStor NVR	>= 4.x, < 5.0.0

References

https://www.qnap.com/en/security-advisory/qsa-23-48Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-23-48Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47565US Government Resource

Timeline

Published: Dec 8, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Dec 21, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-475667.2An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2023-475677.2An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2023-475688.8A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allo CVE-2023-47575.4The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from t CVE-2023-475738.8An issue discovered in Relyum RELY-PCIe 22.2.1 devices. The authorization mechanism is not enforced in the web interface, allowing a low-pri CVE-2023-475745.9An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. There is a Weak SMB configuration with signing disabled.CVE-2023-475756.1An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. The web interfaces of the Relyum devices are susceptible to CVE-2023-475768.8An issue was discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices, allowing authenticated command injection through the web int CVE-2023-475779.8An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current pass CVE-2023-475788.8Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices are susceptible to Cross Site Request Forgery (CSRF) attacks due to the absence of CSRF CVE-2023-475797.5Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the o CVE-2023-47585.5Buffer Over-read in GitHub repository gpac/gpac prior to 2.3-DEV.