CVE-2023-47565 QNAP VioStor NVR OS Command Injection
Authenticated attackers can execute arbitrary OS commands on legacy QNAP VioStor NVR devices via network access.
- Exploited in the wild
- Since 21 Dec 2023
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-47565?
CVE-2023-47565 is a high-severity command injection vulnerability in QNAP Systems Inc. VioStor NVR, published on 8 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We have already fixed the vulnerability in the following versions:
QVR Firmware 5.0.0 and later
Weakness: CWE-78
Which versions are affected by CVE-2023-47565?
It affects 1 product.
Products include Qnap Qvr Firmware.
How do I fix CVE-2023-47565?
No fix has been published for CVE-2023-47565 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 11 Jan 2024.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-47565 being exploited?
Yes. Attackers have exploited CVE-2023-47565 in the wild since at least 21 Dec 2023.
Sources
Also known as GHSA-vj55-4r38-w2gh.