PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-47565 QNAP CVE debrief

CVE-2023-47565 is a QNAP VioStor NVR OS command injection vulnerability that CISA listed in its Known Exploited Vulnerabilities catalog on 2023-12-21. The presence of this entry means the issue is known to be exploited in the wild, so defenders should treat it as a high-priority remediation item. CISA’s guidance for KEV entries is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable.

Vendor
QNAP
Product
VioStor NVR
CVSS
HIGH 8
CISA KEV
Listed
Original CVE published
2023-12-21
Original CVE updated
2023-12-21
Advisory published
2023-12-21
Advisory updated
2023-12-21

Who should care

Organizations that still operate QNAP VioStor NVR systems, especially teams responsible for security, infrastructure, and any internet-facing or remotely accessible deployments.

Technical summary

The supplied corpus identifies the issue as an OS command injection vulnerability in QNAP VioStor NVR. CISA’s KEV record adds the product and vulnerability on 2023-12-21 and sets a due date of 2024-01-11. No CVSS score was supplied in the source corpus, so prioritization here is driven by known exploitation status rather than a numerical severity score.

Defensive priority

High / urgent. KEV listing indicates active exploitation risk and warrants immediate attention, with remediation prioritized before or by the CISA due date.

Recommended defensive actions

  • Apply mitigations per the vendor’s official instructions referenced in the QNAP advisory.
  • If mitigations are unavailable, discontinue use of the product as CISA recommends for KEV entries.
  • Inventory all QNAP VioStor NVR deployments and identify any exposed to untrusted networks.
  • Restrict network access to the device to the minimum necessary while remediation is in progress.
  • Monitor the environment for unusual administrative actions or unexpected command execution activity.
  • Review the official QNAP advisory and NVD entry for product-specific remediation guidance.

Evidence notes

This debrief is based on the supplied CVE metadata and the CISA KEV source item. The source corpus names the issue as a QNAP VioStor NVR OS command injection vulnerability, marks it as a KEV entry, and records dateAdded as 2023-12-21 with dueDate 2024-01-11. The supplied notes also reference the QNAP security advisory and NVD record. No additional exploit details, affected-version data, or CVSS score were provided in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-47565 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-47565

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-47565 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-47565

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.