High severity · published Dec 8, 2023
CVE-2023-47565
Legacy VioStor NVR
In wildKEV
8.8
CVSS
73.3%
EPSS
Yes
On KEV
Description
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We have already fixed the vulnerability in the following versions:
QVR Firmware 5.0.0 and later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)73.3% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 21, 2023
Federal remediation dueJan 11, 2024
Ransomware campaign useNot known
Affected products
Which versions
VN
VioStor NVR · QNAP Systems Inc.
4.x before 5.0.0 · source: vendor, KEV
QF
Qvr Firmware · Qnap
4.0.0 before 5.0.0 · source: NVD