긴급도 83/100 심각도 8 · 높음 악용확률 99.5% CISA KEV · 2023-12-21 CWE-78

CVE-2023-47565

CISA 기관 조치 기한: 2024-01-11

QNAP VioStor NVR

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following versions:

QVR Firmware 5.0.0 and later

KEV 필수 조치: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

타임라인

2023-12-08 NVD 공개
2023-12-21 CISA KEV 등재(실제 악용 확인) 공개 후 13일
2024-01-11 CISA 기관 조치 기한 경과

벡터: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD 상세 ↗ 벤더 권고문 ↗ 참고 링크 ↗