CVE-2023-47565: QNAP VioStor NVR QVR Firmware OS Command Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a very high EPSS score and allows authenticated remote command execution, so it is being exploited and must be remediated immediately.

What it is

QVR Firmware 4.x on legacy QNAP VioStor NVR models contains an OS command injection flaw (CWE-78). An authenticated user can inject and execute arbitrary commands over the network, and the vendor fixed it in QVR Firmware 5.0.0 and later.

Impact

An attacker with valid credentials gains remote command execution on the NVR, leading to full compromise of confidentiality, integrity and availability of the device. Because it is an NVR, this can expose camera feeds, recordings and the underlying host.

Attack surface

Reachable over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N). The attacker must already hold a valid account on the affected QVR 4.x system.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2023-12-21, indicating active exploitation, and EPSS gives a 30-day probability of 0.73277 (99.4th percentile). No ransomware campaign use is documented.

What to do

• Upgrade legacy VioStor NVR devices to QVR Firmware 5.0.0 or later as directed in QNAP advisory QSA-23-48.
• If upgrade is not possible, discontinue use of the affected product per CISA KEV required action.
• Restrict network access to the NVR management interface to trusted hosts only.
• Audit and reduce accounts with access to the NVR; remove unused or default credentials.
• Monitor for and rotate any credentials that may have been exposed on affected devices.

Detection

• Search NVR and web server logs for command-injection patterns or unexpected shell metacharacters in requests to QVR endpoints.
• Alert on unexpected child processes spawned by the NVR web service, such as shells or system utilities.
• Monitor for outbound connections from NVR devices to unfamiliar hosts, which may indicate post-exploitation activity.
• Review authentication logs for anomalous or newly created accounts on QVR 4.x systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.