U.S. CISA adds a flaw in Digiever DS-2105 Pro to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Digiever DS-2105 Pro vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, tracked as CVE-2023-52163 with a CVSS score of 8.8. The issue affects DS-2105 Pro network video recorders running firmware version 3.1.0.71-11, where a command injection in the time_tzsetup.cgi CGI script could allow a remote attacker to execute arbitrary OS commands via specially crafted HTTP inputs.

Exploitation could lead to full compromise of the device, including unauthorized access, configuration changes, and data exposure, with potentially the device being used as a pivot for further attacks; the vulnerability affects end-of-life products that no longer receive security updates.

Federal agencies are required to address the flaw by 12 January 2026, according to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, while private organisations are advised to review the KEV catalog and mitigate accordingly.