Veille CVE
CVE-2023-47565
8.8 Élevée Exploitée activementCatalogue CISA KEV — QNAP VioStor NVR OS Command Injection Vulnerability
Ajoutée le 21/12/2023 · Échéance de correction (agences US) : 11/01/2024
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.0 Élevée | security@qnapsecurity.com.tw | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 8.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://www.qnap.com/en/security-advisory/qsa-23-48 Vendor Advisory
- https://www.qnap.com/en/security-advisory/qsa-23-48 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47565 US Government Resource