CVE-2023-52163

What it actually does

CVE-2023-52163 is a command injection vulnerability in the Digiever DS-2105 Pro NVR firmware 3.1.0.71-11, affecting the time_tzsetup.cgi component. An attacker who can reach the vulnerable CGI endpoint can inject operating-system commands through crafted HTTP input, causing the device to execute attacker-controlled shell commands with the privileges of the web service or underlying device process. Because the affected product is no longer supported by the maintainer, there are no vendor-provided fixed versions listed, making replacement or removal from exposure the primary remediation path.

Why it matters to the business

Successful exploitation can give an attacker control over a vulnerable network video recorder, allowing surveillance disruption, credential theft, malware deployment, participation in botnets, pivoting into adjacent networks, or destruction of video evidence. The risk is urgent because exploitation is confirmed in the wild, the EPSS score is very high at 0.96921, and the issue is listed in CISA KEV with a remediation due date of 2026-01-12. Since the affected device line is unsupported, organizations may face operational replacement costs and should treat continued internet exposure as a high-risk condition.

How an attack unfolds

An attacker first scans for internet- or network-accessible Digiever DS-2105 Pro NVRs exposing the web management interface. After identifying a device running vulnerable firmware, the attacker sends a crafted HTTP request to the time_tzsetup.cgi endpoint with shell metacharacters or encoded command separators embedded in a parameter processed by the timezone setup functionality. The vulnerable CGI handler passes attacker-controlled input to the operating system without proper sanitization, causing commands such as downloading a payload, changing permissions, launching a shell script, adding persistence, or joining a botnet to execute on the appliance. Public exploitation activity has been associated with campaigns targeting Digiever NVRs, so defenders should assume opportunistic scanning and automated exploitation are likely wherever vulnerable devices are reachable.

How to fix it

Because the affected product is no longer supported and no fixed versions are provided, the safest remediation is to retire and replace affected Digiever DS-2105 Pro devices. If immediate replacement is not possible, remove the management interface from the internet, block inbound access from untrusted networks, restrict administration to a dedicated management VLAN or VPN, enforce firewall allowlists, and monitor for exploitation attempts. Disable unnecessary services, rotate credentials used on or near the device, and consider factory reset or full reimaging only as a temporary recovery step because the underlying vulnerability remains. Treat any exposed vulnerable device as potentially compromised and prioritize replacement before the CISA KEV due date of 2026-01-12.

How to confirm the fix worked

Confirm whether any Digiever DS-2105 Pro devices remain in service and identify firmware version 3.1.0.71-11 through the device web interface, asset inventory, vulnerability scanning, or authenticated inspection. Validate that the vulnerable web management interface is not reachable from the internet or untrusted networks by performing external exposure scans and firewall rule reviews. Attempt to access time_tzsetup.cgi only in an authorized, non-destructive way to confirm whether the endpoint is exposed; do not test with live command injection payloads in production unless using an approved security validation process. After mitigation, verify that only approved management networks can reach the device and that replacement devices are running supported firmware.

Typical attack path

1. Scan public IP ranges or internal networks for Digiever NVR web interfaces.
2. Fingerprint exposed devices and firmware behavior to identify Digiever DS-2105 Pro systems running vulnerable 3.1.0.71-11 firmware.
3. Send a crafted request to time_tzsetup.cgi containing shell command separators or encoded shell metacharacters.
4. Execute commands on the NVR through the vulnerable CGI process.
5. Download and run malware, reconnaissance scripts, reverse shells, or botnet payloads using utilities such as wget, curl, tftp, sh, chmod, or busybox.
6. Establish persistence if possible, disable services or logging, or use the device as a foothold to scan and attack other systems.

How to detect it

Check for prior exploitation using web access logs from the NVR, reverse proxies, WAFs, firewalls, VPN concentrators, IDS/IPS sensors, NetFlow, DNS logs, and any centralized syslog collected from the device. Look for HTTP requests to time_tzsetup.cgi containing semicolons, pipes, backticks, dollar-parentheses, URL-encoded command separators, or commands such as wget, curl, tftp, busybox, chmod, sh, nc, telnet, or python. Investigate outbound connections from the NVR to unfamiliar internet hosts shortly after requests to the CGI endpoint, especially downloads of scripts or architecture-specific Linux binaries. On the device, where forensic access is possible, look for unexpected processes, new startup entries, modified web files, suspicious files in /tmp or /var/tmp, unauthorized crontab entries, deleted logs, or signs of botnet behavior such as scanning traffic. Because exploitation is active in the wild and device logging may be limited, absence of logs should not be treated as proof of no compromise.

• time_tzsetup.cgi
• /cgi-bin/time_tzsetup.cgi
• GET /cgi-bin/time_tzsetup.cgi
• POST /cgi-bin/time_tzsetup.cgi
• time_tzsetup.cgi?
• time_tzsetup.cgi%3B
• time_tzsetup.cgi%7C
• time_tzsetup.cgi%26
• time_tzsetup.cgi%60
• time_tzsetup.cgi%24%28
• time_tzsetup.cgi;
• time_tzsetup.cgi|
• time_tzsetup.cgi`
• time_tzsetup.cgi$(
• wget http
• curl http
• tftp -g
• busybox wget
• chmod +x
• /tmp/
• /var/tmp/
• /bin/sh
• sh -c
• nc -e
• telnetd

What your security team should do

• Immediately identify all Digiever DS-2105 Pro NVRs and determine whether any are running firmware 3.1.0.71-11.
• Prioritize removal or replacement of affected devices because the product is unsupported and no vendor fixed version is available.
• Block internet access to all Digiever NVR management interfaces and restrict administration to trusted management networks or VPN access only.
• Search historical web, firewall, proxy, IDS, and device logs for requests to time_tzsetup.cgi, especially requests containing shell metacharacters or encoded command separators.
• Treat exposed vulnerable devices as potentially compromised; isolate them, preserve logs where possible, rotate related credentials, and inspect for malware or unauthorized processes.
• Add SIEM and IDS detections for access to time_tzsetup.cgi combined with command-injection characters, download utilities, or suspicious outbound connections.
• Review outbound network traffic from NVR segments for unexpected connections to external IPs, high-volume scanning, or malware download activity.
• Track CISA KEV remediation requirements and complete remediation before the 2026-01-12 due date.