CISA Flags Actively Exploited Digiever NVR Vulnerability Allowing Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Digiever DS-2105 Pro network video recorders to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The flaw, tracked as CVE-2023-52163 (CVSS score: 8.8), relates to a command injection that could enable post-authentication remote code execution, described by CISA as a missing authorization vulnerability that could be exploited via time_tzsetup.cgi.

The KEV addition comes amid multiple reports from Akamai and Fortinet that threat actors have used the flaw to deliver botnets such as Mirai and ShadowV2. According to TXOne Research, security researcher Ta-Lun Yen, the vulnerability, alongside an arbitrary file read bug (CVE-2023-52164, CVSS 5.1), remains unpatched due to the device reaching end-of-life.

Successful exploitation requires an attacker to be logged into the device and issue a crafted request, and in the absence of a patch, users are advised not to expose the device to the internet and to change default credentials. CISA also urged that Federal Civilian Executive Branch agencies apply mitigations or discontinue use by 12 January 2025.