PT-2023-8130 · Qnap · Nvr Firmware+1
Chad Seaman
+1
·
Published
2023-12-07
·
Updated
2025-10-10
·
CVE-2023-47565
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
QNAP VioStor NVR models running QVR Firmware versions prior to 5.0.0
Description
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models. If exploited, the vulnerability could allow authenticated users to execute commands via a network. The vulnerability exists due to the lack of measures to neutralize special elements. It is reported that the vulnerability has been exploited in the wild. Approximately 27,804 devices are potentially affected, mainly distributed in Japan, Mexico, and other countries.
Recommendations
For QVR Firmware versions prior to 5.0.0, update to QVR Firmware 5.0.0 or later to resolve the issue. As a temporary workaround, consider restricting network access to the vulnerable devices until a patch is applied. Avoid using the vulnerable QVR Firmware versions until the issue is resolved.
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Qnap Viostor Nvr
Nvr Firmware