CVE-2023-47565

What it actually does

This vulnerability is an authenticated OS command injection issue affecting legacy QNAP VioStor NVR models running QVR Firmware 4.x. A low-privileged authenticated user with network access can cause the device to execute attacker-controlled operating system commands. Successful exploitation can compromise confidentiality, integrity, and availability by allowing command execution in the context of the vulnerable service, potentially enabling data access, configuration changes, persistence, malware deployment, or full device takeover depending on service privileges.

Why it matters to the business

Compromise of a network video recorder can disrupt physical security monitoring, expose stored or live video, provide an attacker with a foothold inside the network, and enable further lateral movement. This issue is listed in CISA KEV, has active exploitation in the wild, and has a high EPSS probability of exploitation, so unpatched exposed devices should be treated as urgent remediation items. The CISA remediation due date was 2024-01-11, meaning any remaining vulnerable systems are substantially overdue for patching.

How an attack unfolds

An attacker first needs network reachability to the affected QVR Firmware 4.x interface and valid credentials or a way to obtain them. After authenticating, the attacker sends a crafted request to a vulnerable function that fails to safely separate user-controlled input from operating system command execution. The device passes the malicious input to the underlying shell or command interpreter, causing the attacker-supplied command to run. The attacker may then enumerate the device, retrieve video or configuration data, create persistence, download additional tools, alter recordings or settings, disable services, or use the NVR as an internal pivot point.

How to fix it

Upgrade affected QNAP VioStor NVR devices from QVR Firmware 4.x to QVR Firmware 5.0.0 or later. Where immediate upgrade is not possible, remove direct internet exposure, restrict management access to trusted administrative networks or VPNs, disable unnecessary services, rotate device credentials, enforce unique administrator passwords, and monitor for suspicious command execution or outbound connections. Because the supplied package metadata also lists NocoDB artifacts, verify inventory mappings before actioning package-specific remediation; if NocoDB is actually present in scope, ensure npm package nocodb is upgraded to 0.202.10 or later and source deployments include commit 4291c634262282dbeb41f83bd72227f086f8146f or later.

How to confirm the fix worked

Confirm that all QNAP VioStor NVR devices are running QVR Firmware 5.0.0 or later and that no QVR Firmware 4.x instances remain reachable. Validate exposure by reviewing asset inventory, network scans, firmware banners, administrative UI version information, and QNAP management records. Attempt only authorized, non-destructive validation: verify that authenticated low-privileged users cannot trigger shell metacharacter handling in affected request parameters and that suspicious command execution is not observed. Confirm compensating controls by testing that administrative interfaces are not reachable from untrusted networks and that access is restricted to approved management paths.

Typical attack path

1. Identify QNAP VioStor NVR devices running legacy QVR Firmware 4.x that are reachable over the network.
2. Obtain or reuse valid credentials for the QVR interface.
3. Authenticate to the device as a low-privileged user.
4. Send a crafted request containing shell metacharacters or command payloads to the vulnerable function.
5. Achieve operating system command execution on the NVR.
6. Run discovery commands, collect configuration or video data, and assess service privileges.
7. Deploy persistence, malware, or remote access tooling if write access is available.
8. Use the compromised NVR for disruption, surveillance-data theft, or lateral movement.

How to detect it

Review QNAP VioStor/QVR access logs, web server logs, authentication logs, system logs, process execution records if available, startup scripts, scheduled tasks, and outbound network telemetry. Look for authenticated requests from unusual source addresses, logins followed by unexpected shell activity, command separators or URL-encoded shell metacharacters in HTTP parameters, downloads of files into temporary directories, unexpected outbound connections from the NVR, modified initialization scripts, unknown cron entries, and execution of embedded Linux utilities such as sh, busybox, wget, curl, nc, telnet, tftp, chmod, or crontab. Because exploitation requires authentication, correlate suspicious requests with successful login events and credential reuse patterns. For active-in-the-wild context, prioritize any internet-exposed or broadly reachable QVR Firmware 4.x devices, and investigate historical telemetry back to at least the publication date if logs are retained.

• QVR Firmware 4.
• sh -c
• /bin/sh
• busybox wget
• busybox nc
• wget http://
• wget https://
• curl http://
• curl https://
• tftp -g
• chmod +x /tmp/
• /tmp/
• /var/tmp/
• /dev/shm/
• crontab -e
• /etc/crontab
• /etc/init.d/
• rc.local
• ;wget
• ;curl
• |wget
• |curl
• %3Bwget
• %3Bcurl
• %7Cwget
• %7Ccurl
• `wget
• `curl
• $(wget
• $(curl
• nc -e
• telnetd
• dropbear

What your security team should do

• Treat this as high priority because it is in CISA KEV, has active in-the-wild exploitation, and the remediation deadline has passed.
• Inventory all QNAP VioStor NVR and QVR Firmware deployments and identify any systems still running QVR Firmware 4.x.
• Upgrade affected devices to QVR Firmware 5.0.0 or later as the primary fix.
• Immediately restrict network access to QVR administrative interfaces to trusted administrative networks or VPNs only.
• Rotate credentials for affected devices, especially where compromise is suspected or credentials were shared across devices.
• Review device logs, network telemetry, and filesystem artifacts for evidence of command execution, malware staging, or persistence.
• Isolate and forensically preserve any device showing suspicious shell activity, unexpected outbound connections, unknown scheduled tasks, or modified startup scripts.
• Verify the apparent NocoDB package data in the vulnerability record before applying software-package remediation, because it does not align with the QNAP firmware advisory description.