U.S. CISA adds a flaw in Digiever DS-2105 Pro to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-52163 | Missing Authorization Enables Command Injection in Digiever DS-2105 Pro NVRs Digiever DS-2105 Pro network video recorders (firmware version 3.1.0.71-11 is cited in the advisory) expose a time_tzsetup.cgi endpoint that fails to properly enforce authorization (CWE-862), and crafted requests to it trigger operating-system command injection; the CVSS 8.8 score reflects network reachability, low privilege requirements, and no user interaction. Successful exploitation yields command execution on the device with high impact on confidentiality, integrity, and availability — effectively remote code execution, which makes these NVRs attractive targets for IoT botnets such as the RondoDox campaign and the Mirai-variant ShadowV2. Only organizations still running the DS-2105 Pro (or DS-2105 Pro+) are affected, and because the vendor no longer supports the product, unpatched internet-facing units are the primary risk. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-12-22, EPSS puts the 30-day exploitation probability at 96.9%, and ransomware use is currently unknown. Do: Because the product is end-of-life, check with Digiever for any final firmware update and apply it per vendor instructions; if no patch or mitigation is available, the CISA KEV required action is to discontinue use of the device, and federal agencies must follow BOD 22-01 timelines. In the interim, remove direct internet exposure of the NVR's web interface (restrict via firewall or place behind VPN) and hunt for compromise by looking for suspicious requests to time_tzsetup.cgi and unexpected outbound connections consistent with botnet infection. | 8.8 | 97% | KEV PoC ×3 |
| moderatelikely on the order of thousands of internet-exposed NVRs (estimated; exact install base unknown) |
Full article329 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 23, 2025
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Digiever DS-2105 Pro flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Digiever DS-2105 Pro vulnerability, tracked as CVE-2023-52163 (CVSS Score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog.
Digiever DS-2105 Pro is a network video recorder (NVR) device designed for IP camera surveillance, acting as a standalone Linux-based system that records and manages video feeds from multiple cameras over a network. Users can view live and recorded footage locally or remotely via web interfaces. These devices are commonly used in small to medium-sized security installations.
Digiever DS-2105 Pro devices running firmware version 3.1.0.71-11 are affected by a command injection vulnerability in the time_tzsetup.cgi CGI script. An attacker can trigger the flaw to inject and execute arbitrary operating system commands by sending specially crafted HTTP requests that include malicious input not properly validated or sanitized by the application.
If exploited, the vulnerability could enable a remote attacker to execute commands with the privileges of the web service, potentially leading to full compromise of the device, including unauthorized access, configuration changes, data exposure, or use of the device as a pivot point for further attacks.
The issue only affects end-of-life (EoL) products that are no longer supported or patched by Digiever, meaning no official security updates are available. As a result, affected devices remain permanently vulnerable unless mitigated through compensating controls.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by January 12, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/186021/security/u-s-cisa-adds-a-flaw-in-digiever-ds-2105-pro-to-its-known-exploited-vulnerabilities-catalog.html