CVE-2023-47565: QNAP VioStor NVR OS Command Injection Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-12-21. EPSS: 73.3% chance of exploitation in the next 30 days.

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later

Affected products

• QNAP Qvr Firmware: from 4.0.0, before 5.0.0 (fixed in 5.0.0)

Published 2023-12-08. Last modified 2026-06-17.