---
title: "Digiever DS-2105 Pro CVE-2023-52163: NVR Botnet Bug"
url: https://erroneo.us/security/briefs/digiever-ds-2105-pro-cve-2023-52163-nvr-command-injection/
description: "Command injection in Digiever's time_tzsetup.cgi, used by Mirai-style botnets since 2024. No fix for the unsupported DS-2105 Pro; replace it. In CISA KEV."
type: security-brief
section: "Security Digest"
date_published: 2024-12-19
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-52163"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Digiever DS-2105 Pro CVE-2023-52163: NVR Botnet Bug

**Verdict: Check exposure.** Botnets have used this bug for two years and the DS-2105 Pro will never be fixed; find any unit you own, take it off the internet and replace it, and update other Digiever recorders to current firmware.

- **Who must act:** Owners of a Digiever DS-2105 Pro or other older Digiever network video recorder, especially one whose web interface is reachable from the internet.
- **Who can relax:** Organizations with no Digiever recorders; the bug is in Digiever's own web interface code.
- **Affected:** Digiever DS-2105 Pro and Pro+ firmware 3.1.0.71-11 (no longer supported); Possibly other Digiever NVRs that share the code base, per TXOne
- **Fixed:** None for the DS-2105 Pro; Digiever NVR series covered by TWCERT's September 2025 advisory: firmware x.x.x.79 or later
- **CVEs:** CVE-2023-52163
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory network video recorders and flag any Digiever DS-2105 Pro or other old Digiever model.
2. Replace the DS-2105 Pro; Digiever has said the product was off the shelf years ago and no fix exists.
3. Remove internet exposure of any Digiever web interface and allow management only over VPN or from an admin host.
4. Change default usernames and passwords on every recorder and camera to strong unique ones.
5. Update supported Digiever recorders to firmware x.x.x.79 or later, which also fixes CVE-2025-10264 and CVE-2025-10265.

### How to check if you are affected

- Search web, proxy or IDS logs for POSTs to /cgi-bin/cgi_main.cgi with cgiName=time_tzsetup.cgi and shell characters in the ntp parameter.
- Look for outbound connections from recorders to hailcocks[.]ru or 81.88.18.108, indicators Akamai and Fortinet published.
- Watch for telnet or SSH scanning originating from a recorder, a sign of Mirai-style spreading.
- On updated firmware, check System Log for entries saying an attacking IP has been blocked.

## What happened

The Digiever DS-2105 Pro is a small network video recorder for IP cameras. In July 2023, Ta-Lun Yen of TXOne Research reported two bugs in it to Digiever through TWCERT/CC. The web interface routes requests through `/cgi-bin/cgi_main.cgi`, which calls internal scripts named in a `cgiName` parameter. One of them, `time_tzsetup.cgi`, passes the `ntp` server value to the shell, so shell syntax in that field runs as a command. That is CVE-2023-52163. A second bug, CVE-2023-52164, lets `access_device.cgi` read arbitrary files. Per [TXOne's write-up](https://www.txone.com/blog/digiever-fixes-sorely-needed/), Digiever's answer was that "this product has been off the shelf for five years." No fix followed.

Attackers found it anyway. On December 19, 2024, [Akamai SIRT](https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing) reported a Mirai-based botnet, which names itself "Hail Cock," injecting commands through the `ntp` parameter to download and run its malware. Akamai saw the endpoint targeted from November 18, 2024, in a campaign dating back to at least October. The same botnet also used a TP-Link bug (CVE-2023-1389) and a Teltonika bug (CVE-2018-17532), and spread over telnet and SSH with default passwords. TXOne published its details on January 23, 2025, and the [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-52163) followed on February 3. It notes the bug "only affects products that are no longer supported by the maintainer."

A second botnet followed. [Fortinet](https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices) reported on November 26, 2025 that ShadowV2, another Mirai variant, exploited CVE-2023-52163 among other IoT bugs in late October 2025. CISA [added](https://www.cisa.gov/news-events/alerts/2025/12/22/cisa-adds-one-known-exploited-vulnerability-catalog) the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-52163) on December 22, 2025, with a January 12, 2026 deadline. CISA's enrichment, shown on [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-52163), scores it CVSS 3.1 8.8 and classes it as missing authorization.

## Who is affected

The CVE names the DS-2105 Pro on firmware 3.1.0.71-11. TXOne says Digiever models share a code base, so the bugs "are likely to affect most DigiEver devices." Digiever's [security notice](https://www.digiever.com/tw/support/faq-content.php?FAQ=217) later tied `time_tzsetup.cgi` to both CVE-2023-52163 and CVE-2025-10265. [TWCERT's September 2025 advisory](https://www.twcert.org.tw/en/cp-139-10376-a057c-2.html) lists CVE-2025-10265 and a related unauthenticated configuration-file leak, CVE-2025-10264, across many current Digiever series on firmware x.x.x.78 and earlier, fixed in x.x.x.79.

## Do you really need to act?

Only if you own Digiever recorders, but then yes. TXOne says exploitation needs a login, yet two botnets have used the bug anyway, and Hail Cock also spreads with default passwords. In practice the login is not stopping attackers. [The Hacker News](https://thehackernews.com/2025/12/cisa-flags-actively-exploited-digiever.html) tied the KEV listing to the Akamai and Fortinet reports. Exposure in most companies is tiny. The verdict is to find these units and retire them, not to wait for a patch.

## What to do now

1. Inventory video recorders, including ones installed by contractors, and flag any DS-2105 Pro.
2. Replace the DS-2105 Pro. No fix exists.
3. Take every Digiever web interface off the internet. Digiever itself recommends VPN-only remote access and segmenting recorders from other networks.
4. Change default usernames and passwords on recorders and cameras.
5. Update supported Digiever models to x.x.x.79 or later.

## How to tell if you were hit

Search web, proxy and IDS logs for POST requests to `/cgi-bin/cgi_main.cgi` with `cgiName=time_tzsetup.cgi` and shell characters such as `;`, `$(` or backticks in `ntp`. Look for outbound traffic from recorders to `hailcocks[.]ru` (Akamai) or `81.88.18.108` (Fortinet's ShadowV2 C2), and for telnet or SSH scanning that starts at a recorder. On updated firmware, Digiever logs blocked attackers in the System Log. A recorder that shows any of this should be wiped or, for the DS-2105 Pro, replaced.

## Timeline

- Jul 2023 — TXOne reports the bugs to Digiever.
- Nov 18, 2024 — Akamai first sees the endpoint targeted.
- Dec 19, 2024 — Akamai reports Hail Cock botnet exploitation.
- Feb 3, 2025 — CVE-2023-52163 published.
- Sep 11, 2025 — TWCERT publishes CVE-2025-10264 and CVE-2025-10265.
- Nov 26, 2025 — Fortinet reports ShadowV2 exploitation.
- Dec 22, 2025 — CISA adds the CVE to KEV.

## Sources

1. [Digiever — DIGIEVER security update notice (FAQ 217)](https://www.digiever.com/tw/support/faq-content.php?FAQ=217)
2. [TXOne Networks — Digiever: Fixes Sorely Needed](https://www.txone.com/blog/digiever-fixes-sorely-needed/)
3. [Akamai SIRT — DigiEver Fix That IoT Thing!](https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing)
4. [CVE record — CVE-2023-52163](https://www.cve.org/CVERecord?id=CVE-2023-52163)
5. [NVD — CVE-2023-52163](https://nvd.nist.gov/vuln/detail/CVE-2023-52163)
6. [CISA — Known Exploited Vulnerabilities: CVE-2023-52163](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-52163)
7. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Dec 22, 2025)](https://www.cisa.gov/news-events/alerts/2025/12/22/cisa-adds-one-known-exploited-vulnerability-catalog)
8. [TWCERT/CC — Digiever NVR: 2 vulnerabilities (CVE-2025-10264, CVE-2025-10265)](https://www.twcert.org.tw/en/cp-139-10376-a057c-2.html)
9. [Fortinet FortiGuard Labs — ShadowV2 Casts a Shadow Over IoT Devices](https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices)
10. [The Hacker News — CISA Flags Actively Exploited Digiever NVR Vulnerability (Dec 25, 2025)](https://thehackernews.com/2025/12/cisa-flags-actively-exploited-digiever.html)

---
Source page: https://erroneo.us/security/briefs/digiever-ds-2105-pro-cve-2023-52163-nvr-command-injection/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt