November 15, 2026

CVE Watchtower

CVE-2023-47565QNAP Systems Inc. VioStor NVR OS Command Injection

NVD

Vulnerability Summary

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following versions:

QVR Firmware 5.0.0 and later

Severity Level
HIGH(8.0)
Published Date
Dec 8, 2023
Last Modified
Oct 21, 2025
Exploitation Status
ACTIVE
Root Weakness (CWE)
CWE-78: OS Command Injection ↗
The software constructs all or part of an OS command using externally-influenced input, but does not properly neutralize special elements.
CVSS v3.1 Base Metrics — Score 8.0 (HIGH)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack VectorAdjacent
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

Affected & Patched Versions

Affected Versions
  • QNAP Systems Inc. VioStor NVR >= 4.x and < 5.0.0
Patched Versions
  • QNAP Systems Inc. VioStor NVR 5.0.0

What to do

Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Jan 11, 2024.

  1. Check whether you run QNAP Systems Inc. VioStor NVR and which version.
  2. Update to a patched version listed above, then confirm the new version.
  3. Review logs and exposed services for signs of earlier compromise.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA KEV Status

Listed in Known Exploited Vulnerabilities
Added: Dec 21, 2023
Remediation due: Jan 11, 2024 (deadline passed)

Timeline

  • Dec 8, 2023Published
  • Dec 21, 2023Added to CISA KEV catalog
  • Jan 11, 2024KEV remediation due date
  • Oct 21, 2025Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new QNAP CVEsYou are reading CVE-2023-47565. Get an email when KEV listings, exploits or new CVEs match your stack.
Notify me about QNAP CVEs

Related Coverage

External References

Data last checked: Nov 15, 2026 00:23 UTC