Digiever DS-2105 Pro NVR time_tzsetup.cgi Remote Command Injection Vulnerability (CVE-2023-52163) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTDigiever DS-2105 Pro devices running firmware version 3.1.0.71-11 and prior (including End-of-Life products)
Authenticated attackers can execute arbitrary OS commands with root privileges via the vulnerable CGI script
Immediately isolate affected devices from the public internet and restrict access using firewalls or WAF rules
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Because this product is End-of-Life (EOL), official security patches are not available. It is highly recommended to decommission the device or implement strict network-level mitigations immediately.
2. Temporary Workaround & Hardening Configuration
Restrict access to the NVR web interface using firewall rules (iptables) to ensure only authorized administrative IPs can communicate with the device.
# Block all external access to NVR web ports by default
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
# Allow access only from a trusted administrator IP (e.g., 192.168.1.100)
iptables -I INPUT -s 192.168.1.100 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 192.168.1.100 -p tcp --dport 443 -j ACCEPT3. Log Audit & IoC Verification Commands
Inspect the web server access logs and active processes for signs of exploitation or unauthorized command execution.
# Scan web access logs for suspicious patterns targeting time_tzsetup.cgi
grep 'time_tzsetup.cgi' /var/log/lighttpd/access.log | grep -E '(\||;|\&|\`|\$)'
# Check for suspicious active processes downloading external payloads
ps aux | grep -E '(wget|curl|sh -c|bash -c)' | grep -v grepBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-52163) exists in the time_tzsetup.cgi component of Digiever DS-2105 Pro NVR devices. Due to insufficient input validation and sanitization of user-supplied parameters handling timezone configurations (CWE-862, CWE-78), the application fails to neutralize shell metacharacters before passing them to a system shell.
2. Exploitation Mechanics & Attack Scenario
An attacker with authenticated access (even with low privileges) can craft a malicious HTTP request targeting time_tzsetup.cgi. By injecting shell command delimiters (such as ;, &, or |) into the timezone parameters, the injected commands are executed on the underlying operating system with root privileges. Threat actors, including IoT botnets like ShadowV2, actively exploit this to download and execute malicious payloads.
3. Infrastructure & Business Impact
This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Successful exploitation allows complete device compromise, enabling attackers to intercept video feeds, pivot into internal networks (lateral movement), or enlist the device into DDoS botnets, posing severe physical security and operational risks.
Official Vendor Advisories & References
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Frequently Asked SecOps Questions (CVE-2023-52163)
FAQQ1. How critical is CVE-2023-52163 and is it actively exploited in the wild?
CVE-2023-52163 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 96.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-52163?
Primary impacted vendors include digiever across ds-2105 pro. Scope summary: Digiever DS-2105 Pro firmware version 3.1.0.71-11 and earlier (Note: This product is EOL and no longer supported by the maintainer)
Q3. What temporary mitigations or workarounds exist for CVE-2023-52163 before patching?
[Mitigation] Immediately isolate affected devices from the public internet and restrict access using firewalls or WAF rules Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-52163
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (digiever)
View Category →Kali Forms WordPress Plugin Broken Access Control Vulnerability (CVE-2026-107343): Unauthorized Email Sending and Spoofing
[Affected Scope] Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.30
Arraytics Booktics WordPress Plugin Missing Authorization Vulnerability (CVE-2026-104674)
[Affected Scope] Booktics WordPress plugin versions up to 1.0.31.
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.