CVE-2023-47565: QNAP VioStor NVR OS Command Injection Vulnerability
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later
Published Dec 8, 2023 · Updated Jun 17, 2026
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We have already fixed the vulnerability in the following versions:
QVR Firmware 5.0.0 and later
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More QNAP vulnerabilities
All QNAP entriesCVE-2022-27593
QNAP Photo Station Externally Controlled Reference Vulnerability
critical9.1ExploitedSep 8, 2022CVE-2021-28799
QNAP NAS Improper Authorization Vulnerability
critical9.8ExploitedMay 13, 2021CVE-2020-2509
QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
critical9.8ExploitedApr 17, 2021CVE-2018-19943
QNAP NAS File Station Cross-Site Scripting Vulnerability
medium5.4ExploitedOct 28, 2020CVE-2018-19949
QNAP NAS File Station Command Injection Vulnerability
critical9.8ExploitedOct 28, 2020CVE-2018-19953
QNAP NAS File Station Cross-Site Scripting Vulnerability
medium6.1ExploitedOct 28, 2020