erroneo.us
Search all guides⌘K

Security Digest · Dec 19, 2024 · Vulnerability · Other

Digiever DS-2105 Pro CVE-2023-52163: NVR Botnet Bug

Command injection in Digiever's time_tzsetup.cgi, used by Mirai-style botnets since 2024. No fix for the unsupported DS-2105 Pro; replace it. In CISA KEV.

Published By erroneo.us Security Desk · Updated 3 min read10 sources

Our verdict

Check exposure

Botnets have used this bug for two years and the DS-2105 Pro will never be fixed; find any unit you own, take it off the internet and replace it, and update other Digiever recorders to current firmware.

Who must act: Owners of a Digiever DS-2105 Pro or other older Digiever network video recorder, especially one whose web interface is reachable from the internet.

Who can relax: Organizations with no Digiever recorders; the bug is in Digiever's own web interface code.

Affected
Digiever DS-2105 Pro and Pro+ firmware 3.1.0.71-11 (no longer supported)
Possibly other Digiever NVRs that share the code base, per TXOne
Fixed in
None for the DS-2105 Pro
Digiever NVR series covered by TWCERT's September 2025 advisory: firmware x.x.x.79 or later
CVSS
8.8 (v3.1, CISA-ADP)
EPSS
96.9% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Inventory network video recorders and flag any Digiever DS-2105 Pro or other old Digiever model.
  2. Replace the DS-2105 Pro; Digiever has said the product was off the shelf years ago and no fix exists.
  3. Remove internet exposure of any Digiever web interface and allow management only over VPN or from an admin host.
  4. Change default usernames and passwords on every recorder and camera to strong unique ones.
  5. Update supported Digiever recorders to firmware x.x.x.79 or later, which also fixes CVE-2025-10264 and CVE-2025-10265.

How to check if you are affected or compromised

  • Search web, proxy or IDS logs for POSTs to /cgi-bin/cgi_main.cgi with cgiName=time_tzsetup.cgi and shell characters in the ntp parameter.
  • Look for outbound connections from recorders to hailcocks[.]ru or 81.88.18.108, indicators Akamai and Fortinet published.
  • Watch for telnet or SSH scanning originating from a recorder, a sign of Mirai-style spreading.
  • On updated firmware, check System Log for entries saying an attacking IP has been blocked.

What happened#

The Digiever DS-2105 Pro is a small network video recorder for IP cameras. In July 2023, Ta-Lun Yen of TXOne Research reported two bugs in it to Digiever through TWCERT/CC. The web interface routes requests through /cgi-bin/cgi_main.cgi, which calls internal scripts named in a cgiName parameter. One of them, time_tzsetup.cgi, passes the ntp server value to the shell, so shell syntax in that field runs as a command. That is CVE-2023-52163. A second bug, CVE-2023-52164, lets access_device.cgi read arbitrary files. Per TXOne's write-up, Digiever's answer was that "this product has been off the shelf for five years." No fix followed.

Attackers found it anyway. On December 19, 2024, Akamai SIRT reported a Mirai-based botnet, which names itself "Hail Cock," injecting commands through the ntp parameter to download and run its malware. Akamai saw the endpoint targeted from November 18, 2024, in a campaign dating back to at least October. The same botnet also used a TP-Link bug (CVE-2023-1389) and a Teltonika bug (CVE-2018-17532), and spread over telnet and SSH with default passwords. TXOne published its details on January 23, 2025, and the CVE record followed on February 3. It notes the bug "only affects products that are no longer supported by the maintainer."

A second botnet followed. Fortinet reported on November 26, 2025 that ShadowV2, another Mirai variant, exploited CVE-2023-52163 among other IoT bugs in late October 2025. CISA added the CVE to KEV on December 22, 2025, with a January 12, 2026 deadline. CISA's enrichment, shown on NVD, scores it CVSS 3.1 8.8 and classes it as missing authorization.

Who is affected#

The CVE names the DS-2105 Pro on firmware 3.1.0.71-11. TXOne says Digiever models share a code base, so the bugs "are likely to affect most DigiEver devices." Digiever's security notice later tied time_tzsetup.cgi to both CVE-2023-52163 and CVE-2025-10265. TWCERT's September 2025 advisory lists CVE-2025-10265 and a related unauthenticated configuration-file leak, CVE-2025-10264, across many current Digiever series on firmware x.x.x.78 and earlier, fixed in x.x.x.79.

Do you really need to act?#

Only if you own Digiever recorders, but then yes. TXOne says exploitation needs a login, yet two botnets have used the bug anyway, and Hail Cock also spreads with default passwords. In practice the login is not stopping attackers. The Hacker News tied the KEV listing to the Akamai and Fortinet reports. Exposure in most companies is tiny. The verdict is to find these units and retire them, not to wait for a patch.

What to do now#

  1. Inventory video recorders, including ones installed by contractors, and flag any DS-2105 Pro.
  2. Replace the DS-2105 Pro. No fix exists.
  3. Take every Digiever web interface off the internet. Digiever itself recommends VPN-only remote access and segmenting recorders from other networks.
  4. Change default usernames and passwords on recorders and cameras.
  5. Update supported Digiever models to x.x.x.79 or later.

How to tell if you were hit#

Search web, proxy and IDS logs for POST requests to /cgi-bin/cgi_main.cgi with cgiName=time_tzsetup.cgi and shell characters such as ;, $( or backticks in ntp. Look for outbound traffic from recorders to hailcocks[.]ru (Akamai) or 81.88.18.108 (Fortinet's ShadowV2 C2), and for telnet or SSH scanning that starts at a recorder. On updated firmware, Digiever logs blocked attackers in the System Log. A recorder that shows any of this should be wiped or, for the DS-2105 Pro, replaced.

Timeline#

  • — TXOne reports the bugs to Digiever.
  • — Akamai first sees the endpoint targeted.
  • — Akamai reports Hail Cock botnet exploitation.
  • — CVE-2023-52163 published.
  • — TWCERT publishes CVE-2025-10264 and CVE-2025-10265.
  • — Fortinet reports ShadowV2 exploitation.
  • — CISA adds the CVE to KEV.

Vulnerability records

  • CVE-2023-52163 · KEV 2025-12-22 · Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Digiever — DIGIEVER security update notice (FAQ 217) digiever.com
  2. TXOne Networks — Digiever: Fixes Sorely Needed txone.com
  3. Akamai SIRT — DigiEver Fix That IoT Thing! akamai.com
  4. CVE record — CVE-2023-52163 cve.org
  5. NVD — CVE-2023-52163 nvd.nist.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2023-52163 cisa.gov
  7. CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Dec 22, 2025) cisa.gov
  8. TWCERT/CC — Digiever NVR: 2 vulnerabilities (CVE-2025-10264, CVE-2025-10265) twcert.org.tw
  9. Fortinet FortiGuard Labs — ShadowV2 Casts a Shadow Over IoT Devices fortinet.com

Coverage and analysis

  1. The Hacker News — CISA Flags Actively Exploited Digiever NVR Vulnerability (Dec 25, 2025) thehackernews.com