CVE-2023-47565 - QNAP VioStor NVR OS Command Injection Vulnerability

QNAP | VioStor NVR

• Date Added:
• 2023-12-21

• Due Date:
• 2024-01-11

Vulnerability Name

QNAP VioStor NVR OS Command Injection Vulnerability

Description

QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://www.qnap.com/en/security-advisory/qsa-23-48 ; https://nvd.nist.gov/vuln/detail/CVE-2023-47565

Top Security News

Russian cybercrooks exploiting 7-Zip zero-day vulnerability (CVE-2025-0411)

Garmin GPS watches crashing, stuck in triangle 'reboot loop'

Microsoft fixes exploited zero-day (CVE-2024-49138)

DeepSeek Jailbreak Reveals Its Entire System Prompt

Broadcom Patches VMware Aria Flaws – Exploits May Lead to Credential Theft

Windows Server 2025 released—here are the new features

Engineering giant Smiths Group discloses security breach

Lightning AI Studio Vulnerability Could've Allowed RCE via Hidden URL Parameter

Common Alerts

InformationalCookie Slack Detector

HighPath Traversal

HighXML External Entity Attack

HighLog4Shell (CVE-2021-45046)

HighPath Traversal

HighAdvanced SQL Injection

InformationalGraphQL Endpoint Supports Introspection

LowStrict-Transport-Security Multiple Header Entries (Non-compliant with Spec)

MediumBypassing 403

MediumX-ChromeLogger-Data (XCOLD) Header Information Leak

Latest CVE List

CVE-2024-45195 Apache OFBiz Forced Browsing Vulnerability

CVE-2024-29059 Microsoft .NET Framework Information Disclosure Vulnerability

CVE-2018-9276 Paessler PRTG Network Monitor OS Command Injection Vulnerability

CVE-2018-19410 Paessler PRTG Network Monitor Local File Inclusion Vulnerability

CVE-2025-24085 Apple Multiple Products Use-After-Free Vulnerability

CVE-2025-23006 SonicWall SMA1000 Appliances Deserialization Vulnerability

CVE-2020-11023 JQuery Cross-Site Scripting (XSS) Vulnerability

CVE-2024-50603 Aviatrix Controllers OS Command Injection Vulnerability

CVE-2024-55591 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CVE-2025-21333 Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

Top CWE List

CWE-693 Protection Mechanism Failure

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

MediumCWE-352 Cross-Site Request Forgery (CSRF)

HighCWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-1021 Improper Restriction of Rendered UI Layers or Frames

CWE-1426 Improper Validation of Generative AI Output

CWE-201 Insertion of Sensitive Information Into Sent Data

CWE-284 Improper Access Control

CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

HighCWE-457 Use of Uninitialized Variable