CVE-2023-47563 is an OS command injection flaw in QNAP's Video Station. NVD scores it 7.4, High. The fix is Video Station 5.8.2 and later. Video Station is a media app for QNAP NAS devices. The attacker needs a valid account. Update the app, or remove it if nobody uses it any more.
What's affected
The record lists Video Station without a version range. QNAP's text says the fix is Video Station 5.8.2 and later. This record was published on 6 September 2024, later than the other QNAP issues in the same series, so the update may not have reached units that were already patched earlier in the year.
The weaknesses listed in the record: CWE-77, CWE-78.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. QNAP's advisory page needs a browser to render, so I could not read it directly. The fixed versions below come from the NVD record, which reproduces QNAP's text.
How to check if you're exposed
Open the QNAP management interface and read the version of the affected product. For the operating system, that is the Firmware Update page in Control Panel. For an app, it is the App Center entry. Compare what you see with the fixed versions listed above.
I am not giving a command line check. QNAP's own pages and the device interface are the supported route, and I could not confirm a command that works across all models.
What to do now
- Update Video Station to 5.8.2 or later through the App Center.
- Remove the app on any NAS where nobody uses it.
- Review and trim the list of accounts that can sign in to the NAS.
- Keep NAS services off the internet and use a VPN for remote access.
- Record the Video Station version for each NAS in your inventory.
Why it matters
The weakness is CWE-78, with the parent class CWE-77. A flaw of this kind exists when a program passes unchecked input into a shell command. Text that was meant to be a value becomes part of the command.
This record is a good reminder that a NAS runs many apps, each patched on its own schedule. A device updated in January for one advisory can still be behind on a later one. The only way to know is to read each app's version, not the firmware version alone.
The attacker needs a signed-in account. In a shared environment, such as a small office with a family of accounts, a single weak password gives that account to someone. The score of 7.4 reflects a changed scope and Low impact on each of confidentiality, integrity and availability.
Quick check
Is Video Station fixed in the firmware update?
It is a separate app with its own version, per QNAP's text. Update it in the App Center.
Is this the same bug as Photo Station?
No. The class is the same, but each CVE is a separate flaw in a separate app.
Sources
Last reviewed: 19 October 2026.
