Actively exploited · Published Dec 8, 2023 · Assigned by qnap
CVE-2023-47565Legacy VioStor NVR
High 8.0 Exploited
In plain English
A high-severity OS command injection in VioStor NVR from QNAP Systems Inc.. Attackers are actively exploiting it in the wild (listed by CISA on December 21, 2023). The chance it is exploited in the next 30 days is estimated at 73.3% (higher than 99.5% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jan 11, 2024.
Official description
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | VioStor NVR | 4.x – before 5.0.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H