CVE-2023-52163
Digiever DS-2105 Pro Missing Authorization Vulnerability
Description
CVE-2023-52163 is a high-severity command injection vulnerability (CVSS 8.8) in the Digiever DS-2105 Pro network video recorder (NVR), specifically in the time_tzsetup.cgi interface. The vulnerability allows an authenticated remote attacker to execute arbitrary commands on the device's operating system. This flaw affects firmware version 3.1.0.71-11 and the device is no longer supported by the manufacturer. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 12, 2026, and has an EPSS score of 0.67483 (98.5th percentile), indicating very high exploitation probability. Ransomware association is currently unknown.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| digiever | ds-2105 pro firmware | 3.1.0.71-11 |
| digiever | ds-2105 pro\+ firmware | 3.1.0.71-11 |
References
- https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing(Exploit, Third Party Advisory)
- https://www.txone.com/blog/digiever-fixes-sorely-needed/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-52163(US Government Resource)
- https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices(Exploit, Third Party Advisory)
Weakness Type
CWE-862: Missing Authorization
CWE-862 describes vulnerabilities where software does not perform an authorization check when an actor attempts to access a resource or perform an action. In CVE-2023-52163, the time_tzsetup.cgi endpoint on the Digiever DS-2105 Pro NVR fails to properly authorize or sanitize input before passing it to system command execution functions. While the CVSS vector indicates low privileges are required, the actual command injection occurs because the endpoint does not adequately validate or restrict the operations that authenticated users can perform, allowing them to escape the intended timezone configuration functionality and inject arbitrary OS commands.
Impact Analysis
The business impact of CVE-2023-52163 is severe for organizations still operating Digiever DS-2105 Pro NVR devices. Confidentiality is fully compromised because command injection allows the attacker to read any file on the device, including camera feeds, stored recordings, network configurations, and credentials. Integrity is fully compromised as the attacker can modify device configurations, tamper with video recordings, install persistent backdoors, or use the device as a pivot point for further network attacks. Availability is also fully impacted since the attacker can disable the NVR, delete recordings, or brick the device. The EPSS score of 0.67483 (98.5th percentile) reflects extremely high exploitation probability, and multiple security research organizations including Akamai, TXOne Networks, and Fortinet have published detailed exploit analyses. IoT devices like NVRs are particularly dangerous when compromised because they often have persistent network access, are rarely monitored for security events, and can be conscripted into botnets. The end-of-support status of the DS-2105 Pro means no official patch will be released, making this vulnerability permanently exploitable on these devices.
Exploit Maturity
CVE-2023-52163 has a fully mature and well-documented exploit landscape. It is listed in CISA's KEV catalog with a remediation deadline of January 12, 2026, confirming active exploitation in the wild. The EPSS score of 0.67483 (98.5th percentile) reflects extremely high exploitation probability. Public exploit information is available from multiple authoritative sources: Akamai's security research blog provides a detailed technical breakdown, TXOne Networks documented the exploitation in IoT environments, and Fortinet's threat research identified this vulnerability being exploited by the ShadowV2 botnet variant. The use in botnet campaigns is particularly concerning as it indicates automated, large-scale exploitation. Ransomware association is listed as unknown, but IoT command injection vulnerabilities are increasingly being leveraged in broader attack campaigns.
Remediation
- Replace the Digiever DS-2105 Pro with a supported device — Since this product is end-of-life and no longer receives security updates from the manufacturer, the only reliable remediation is to replace it with a currently supported NVR. No official patch will be released for this vulnerability.
- Isolate the device from the network immediately — If replacement is not immediately possible, place the NVR on a completely isolated network segment with no internet access and strictly limited internal connectivity. Block all inbound connections from untrusted networks.
- Disable remote web management access — If the device must remain operational, disable web-based management access or restrict it to a single trusted management workstation via firewall rules to prevent exploitation of the time_tzsetup.cgi endpoint.
- Monitor for indicators of compromise — Check the device for signs of botnet infection, including unusual outbound network connections, unexpected CPU usage, or modifications to system files. Fortinet's research indicates this vulnerability is actively exploited by the ShadowV2 botnet.
- Audit all IoT devices for similar vulnerabilities — Use this incident as a catalyst to inventory all IoT devices, NVRs, and similar equipment on your network, identify end-of-life products, and establish a lifecycle management program that ensures timely replacement of unsupported devices.
Technical Details
The CVSS v3.1 vector for CVE-2023-52163 is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, yielding a base score of 8.8 (High). Attack Vector (Network) means the vulnerability is exploitable remotely through the NVR's web interface. Attack Complexity (Low) indicates the exploit is straightforward and reliable. Privileges Required (Low) means the attacker needs a basic authenticated session on the device, though default credentials on IoT devices often make this trivial. User Interaction (None) means no legitimate user action is needed. Scope (Unchanged) indicates the impact stays within the device's security context. Confidentiality, Integrity, and Availability are all High, reflecting full device compromise. The attack targets the time_tzsetup.cgi CGI script, which is intended to handle timezone configuration on the NVR. The script accepts user-supplied parameters that are passed directly to operating system commands without proper sanitization or escaping. By injecting shell metacharacters and additional commands into the timezone configuration parameters, an attacker can execute arbitrary commands as the web server process, which typically runs with root or elevated privileges on embedded IoT devices. The simplicity of CGI-based command injection on embedded Linux devices makes this vulnerability particularly easy to weaponize and automate, as demonstrated by its incorporation into the ShadowV2 botnet.
Frequently Asked Questions
Is a patch available for CVE-2023-52163?
No, the Digiever DS-2105 Pro is an end-of-life product that no longer receives security updates. The manufacturer will not release a patch for this vulnerability, making device replacement the only complete remediation.
How is this vulnerability being exploited in the wild?
Research from Fortinet shows that CVE-2023-52163 is being actively exploited by the ShadowV2 botnet, which automates the command injection to conscript vulnerable NVR devices into a botnet used for distributed denial-of-service attacks and other malicious activities.
Can default credentials make exploitation easier?
Yes, while the vulnerability technically requires authentication, many Digiever NVR devices are deployed with default or weak credentials. Attackers frequently combine credential brute-forcing or default credential lists with the command injection to achieve unauthenticated exploitation in practice.
What is the risk of keeping the device running?
Running an unpatched, end-of-life NVR with a known actively exploited vulnerability creates significant risk. The device can be used as a network entry point, conscripted into botnets, or leveraged to access video surveillance feeds. Network isolation is the minimum temporary mitigation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.