CVE-2023-52163

Published Feb 3, 2025

Last updated 2 months ago

DigiEver

Overview

AI description

Automated description summarized from trusted sources.

CVE-2023-52163 is a missing authorization vulnerability affecting DigiEver DS-2105 Pro devices. It allows attackers to execute unauthorized commands through the `time_tzsetup.cgi` interface due to improper access controls. This command injection vulnerability enables remote attackers to inject malicious commands without proper authentication. The vulnerability stems from a failure in the system's ability to verify user permissions. Successful exploitation could allow attackers to manipulate security footage, disable surveillance capabilities, or pivot deeper into enterprise networks. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Description: Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Source: cve@mitre.org
NVD status: Analyzed
CNA Tags: unsupported-when-assigned
Products: ds-2105_pro_firmware, ds-2105_pro\+_firmware

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Digiever DS-2105 Pro Missing Authorization Vulnerability
Exploit added on: Dec 22, 2025
Exploit action due: Jan 12, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-862

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:digiever:ds-2105_pro_firmware:3.1.0.71-11:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0E34BBAA-9BA1-426D-B25A-F718B9F65D4C"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:digiever:ds-2105_pro:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "0C110DB3-9915-4DB4-933D-2EA222841CA1"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:digiever:ds-2105_pro\\+_firmware:3.1.0.71-11:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BD8A7902-3D5A-4446-9243-0119C3BB32D5"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:digiever:ds-2105_pro\\+:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "2352C8C4-144E-4B9D-B9DF-A7B7B2B7FFEB"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.