CVE-2023-47565Legacy VioStor NVR
Explotación conocida — QNAP VioStor NVR OS Command Injection Vulnerability
CISA confirmó el 21.12.2023 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 11.01.2024.
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://www.qnap.com/en/security-advisory/qsa-23-48 ; https://nvd.nist.gov/vuln/detail/CVE-2023-47565
Descripción
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| qnap | qvr firmware | 4.0.0 – < 5.0.0 | |
| QNAP Systems Inc. | VioStor NVR | 4.x – < 5.0.0 |
Referencias y parches
- https://www.qnap.com/en/security-advisory/qsa-23-48 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47565 US Government Resource
Coincidencias CPE (NVD) (1)
cpe:2.3:o:qnap:qvr_firmware:*:*:*:*:*:*:*:*≥ 4.0.0 < 5.0.0