PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-47565 QNAP CVE debrief

CVE-2023-47565 is a QNAP VioStor NVR OS command injection vulnerability that CISA listed in its Known Exploited Vulnerabilities catalog on 2023-12-21. The presence of this entry means the issue is known to be exploited in the wild, so defenders should treat it as a high-priority remediation item. CISA’s guidance for KEV entries is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable.

Vendor
QNAP
Product
VioStor NVR
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2023-12-21
Original CVE updated
2023-12-21
Advisory published
2023-12-21
Advisory updated
2023-12-21

Who should care

Organizations that still operate QNAP VioStor NVR systems, especially teams responsible for security, infrastructure, and any internet-facing or remotely accessible deployments.

Technical summary

The supplied corpus identifies the issue as an OS command injection vulnerability in QNAP VioStor NVR. CISA’s KEV record adds the product and vulnerability on 2023-12-21 and sets a due date of 2024-01-11. No CVSS score was supplied in the source corpus, so prioritization here is driven by known exploitation status rather than a numerical severity score.

Defensive priority

High / urgent. KEV listing indicates active exploitation risk and warrants immediate attention, with remediation prioritized before or by the CISA due date.

Recommended defensive actions

  • Apply mitigations per the vendor’s official instructions referenced in the QNAP advisory.
  • If mitigations are unavailable, discontinue use of the product as CISA recommends for KEV entries.
  • Inventory all QNAP VioStor NVR deployments and identify any exposed to untrusted networks.
  • Restrict network access to the device to the minimum necessary while remediation is in progress.
  • Monitor the environment for unusual administrative actions or unexpected command execution activity.
  • Review the official QNAP advisory and NVD entry for product-specific remediation guidance.

Evidence notes

This debrief is based on the supplied CVE metadata and the CISA KEV source item. The source corpus names the issue as a QNAP VioStor NVR OS command injection vulnerability, marks it as a KEV entry, and records dateAdded as 2023-12-21 with dueDate 2024-01-11. The supplied notes also reference the QNAP security advisory and NVD record. No additional exploit details, affected-version data, or CVSS score were provided in the corpus.

Official resources

CVE published: 2023-12-21. CISA KEV date added: 2023-12-21. CISA due date: 2024-01-11.