CVE-2023-47565
QNAP VioStor NVR OS Command Injection Vulnerability
Description
CVE-2023-47565 is an OS command injection vulnerability affecting legacy QNAP VioStor NVR (Network Video Recorder) devices running QVR Firmware version 4.x. This weakness, classified as CWE-78 (Improper Neutralization of Special Elements Used in an OS Command), allows an authenticated user with network-adjacent access to execute arbitrary operating system commands on the affected device. CISA has included CVE-2023-47565 in its Known Exploited Vulnerabilities (KEV) catalog, and with an EPSS score in the 99th percentile, the vulnerability is considered highly likely to be exploited in real-world attacks. Organizations still operating these legacy NVR devices should apply the vendor’s patched firmware (QVR Firmware 5.0.0 or later) immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qnap | qvr firmware | >= 4.0.0, < 5.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.qnap.com/en/security-advisory/qsa-23-48(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47565(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements Used in an OS Command (OS Command Injection)
CVE-2023-47565 is rooted in the failure of QNAP VioStor NVR’s QVR Firmware 4.x to properly sanitize user-supplied input before incorporating it into OS-level shell commands. An authenticated user can inject shell metacharacters or command separators into affected input fields, causing the firmware to execute arbitrary commands with the privileges of the underlying process.
Learn more: CWE-78 — Improper Neutralization of Special Elements Used in an OS Command
Impact Analysis
CVE-2023-47565 has a CVSS v3.1 base score of 8.0 (HIGH). The attack vector is Adjacent Network (A), meaning the attacker must be on the same network segment or VLAN as the target — not necessarily the open internet. Attack complexity is Low, Low privileges are required (authenticated access), and no user interaction is needed.
Confidentiality Impact: High — An attacker can read all data stored on or accessible through the NVR, including video footage, credentials, and network configuration.
Integrity Impact: High — Arbitrary command execution can modify device configuration, corrupt recordings, or install persistent malware.
Availability Impact: High — The device can be disrupted, rebooted, or fully compromised, interrupting surveillance operations.
For security-critical environments where these NVR devices monitor physical access or sensitive areas, a full compromise of this device could have serious physical security implications beyond the digital impact.
Exploit Maturity
CVE-2023-47565 has been confirmed as actively exploited, with CISA including it in the Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of January 11, 2024. The EPSS score of 0.860 places this vulnerability in the 99th percentile, meaning it is among the most likely CVEs to be exploited across all published vulnerabilities. The vendor (QNAP) issued its security advisory QSA-23-48 in response, and the vulnerability has attracted significant attention from the security research community due to the widespread deployment of VioStor NVR devices in surveillance environments. Ransomware association is Unknown.
Remediation
- Upgrade QVR Firmware to version 5.0.0 or later immediately. QNAP released QVR Firmware 5.0.0 to address this vulnerability, as documented in security advisory QSA-23-48.
- Isolate legacy VioStor NVR devices from the broader network using network segmentation or VLANs until a firmware update can be applied, reducing the adjacent network attack surface.
- Restrict authenticated access to the NVR management interface to only authorized administrative accounts with strong, unique passwords.
- Audit all NVR devices in the fleet to identify which models are running QVR Firmware 4.x and prioritize their remediation.
- Apply mitigations per vendor instructions as required by the CISA KEV catalog, or discontinue use of the product if mitigations (firmware upgrade) are unavailable for the specific hardware model.
- Monitor for anomalous device behavior such as unexpected outbound connections or configuration changes, which may indicate prior compromise.
Technical Details
CVE-2023-47565 is an OS command injection vulnerability (CWE-78) present in the QVR Firmware version 4.x used by legacy QNAP VioStor NVR models. The vulnerability exists because the firmware does not adequately validate or sanitize user-supplied input before passing it to OS shell commands.
Attack vector: The attack requires adjacent network access — the attacker must be on the same local network, VLAN, or otherwise network-adjacent to the VioStor NVR. Authentication with at least low-privilege credentials is required before the vulnerable functionality can be accessed.
Command execution: Once authenticated, a malicious user can submit specially crafted input to vulnerable parameters exposed through the device’s management interface. Shell metacharacters in this input are interpreted by the OS, resulting in arbitrary command execution within the firmware’s process context.
Affected models: Legacy QNAP VioStor NVR models running QVR Firmware 4.x are affected. QNAP clarified that QVR Firmware 5.0.0 and later are not vulnerable.
Disclosure and patching: QNAP published security advisory QSA-23-48 and released patched firmware (QVR Firmware 5.0.0) to address the issue.
Frequently Asked Questions
What is CVE-2023-47565?
CVE-2023-47565 is an OS command injection vulnerability in legacy QNAP VioStor NVR devices running QVR Firmware 4.x. An authenticated user on the same network can exploit this flaw to execute arbitrary commands on the device.
Is CVE-2023-47565 being actively exploited?
Yes. CISA has listed CVE-2023-47565 in the Known Exploited Vulnerabilities (KEV) catalog with a January 11, 2024 remediation deadline. Its EPSS score of 0.860 (99th percentile) reflects very high real-world exploitation probability.
Which QNAP products are affected by CVE-2023-47565?
Legacy QNAP VioStor NVR models running QVR Firmware version 4.x are affected. Devices already running QVR Firmware 5.0.0 or later are not vulnerable according to QNAP’s security advisory QSA-23-48.
How can I fix CVE-2023-47565?
Upgrade the QVR Firmware on all affected VioStor NVR devices to version 5.0.0 or later. If a firmware upgrade is not possible for a specific legacy model, isolate the device from the network and contact QNAP for further guidance.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.