CVE-2023-47562 is an OS command injection flaw in QNAP's Photo Station. NVD scores it 7.4, High. The fix is Photo Station 6.4.2 (2023/12/15) and later. Photo Station is an older photo app for QNAP NAS devices. The attacker needs a valid account. Update the app, or remove it if nobody uses it any more.
What's affected
The record lists Photo Station without a version range. QNAP's text names the fix as Photo Station 6.4.2 (2023/12/15) and later, so earlier builds should be treated as affected.
The weaknesses listed in the record: CWE-77, CWE-78.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. QNAP's advisory page needs a browser to render, so I could not read it directly. The fixed versions below come from the NVD record, which reproduces QNAP's text.
How to check if you're exposed
Open the QNAP management interface and read the version of the affected product. For the operating system, that is the Firmware Update page in Control Panel. For an app, it is the App Center entry. Compare what you see with the fixed versions listed above.
I am not giving a command line check. QNAP's own pages and the device interface are the supported route, and I could not confirm a command that works across all models.
What to do now
- Update Photo Station to 6.4.2 (build dated 2023/12/15) or later through the App Center.
- If you no longer use Photo Station, uninstall it. QNAP has moved photo features to other apps, and a removed app cannot be attacked.
- Review the accounts on each NAS, and disable those you do not need.
- Keep the NAS off the public internet, and reach it through a VPN.
- Record the app version in your inventory for each NAS.
Why it matters
This is another CWE-78 case, and the same class as the QuMagie flaw covered in a sibling post. An app builds an operating system command from input without removing the special characters that change its meaning. The related CWE-77 describes the same thing in broader terms.
The score is 7.4 because the vector marks a changed scope: a flaw in one app can reach beyond that app. The three impact ratings are Low each. The attacker needs a valid account and no user interaction.
For teams, the useful habit is to treat every installed NAS app as part of the attack surface. Apps you stopped using are still code that can be called. If Photo Station sits on a NAS that you moved off long ago, the better fix is removal, not the update.
Quick check
Which build fixes it?
Photo Station 6.4.2, dated 15 December 2023, and later, per QNAP's text in the record.
Is this the same as the QuMagie flaw?
The class is the same, but they are separate CVEs in separate apps, each with its own fixed version.
Sources
Last reviewed: 19 October 2026.
