Command Injection Vulnerability in Digiever DS-2105 Pro

Historical catalog analysis: CISA added this entry on December 22, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2023-52163 is a missing authorization vulnerability (CWE-862) identified in the Digiever DS-2105 Pro. The flaw exists within the time_tzsetup.cgi component, where a lack of proper authorization checks could allow an attacker to perform command injection on the affected system.

Exposure and applicability

This vulnerability specifically affects organizations deploying the Digiever DS-2105 Pro hardware. Because the entry point is a CGI script associated with time zone setup, assets exposed to untrusted networks or those with insufficient internal segmentation are at higher risk of unauthorized access to this endpoint. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on December 22, 2025, indicating that the flaw has been observed in active exploitation.

Remediation priorities

Based on the reported exposure, we analyze the following prioritization for vulnerability management teams:

1. Asset Identification: Immediately audit infrastructure to identify all deployed DS-2105 Pro units. Priority should be given to devices with network-accessible management interfaces.
2. Vendor Mitigation Application: Apply official mitigations provided by Digiever. If vendor instructions are unavailable or cannot be applied, the source suggests discontinuing use of the product to eliminate the risk.
3. Network Isolation: As a compensating control, restrict access to the device’s management interface to trusted administrative networks only, reducing the likelihood of external actors reaching the time_tzsetup.cgi endpoint.

How to validate remediation

Verification must move beyond simple version checks, as a firmware update does not inherently guarantee that the specific logic flaw in the CGI script has been neutralized.

Defenders should verify remediation by confirming that the time_tzsetup.cgi endpoint now requires valid authorization before accepting input. Validation is achieved when unauthorized requests to this endpoint are rejected with an appropriate error (e.g., 401 Unauthorized or 403 Forbidden) rather than processing the request. This can be tested using authorized security scanning tools or manual requests in a controlled environment.

Limits and open questions

While the vulnerability is listed as known to be exploited, it remains unknown whether this flaw has been utilized specifically by ransomware campaigns. Furthermore, while CISA has established a remediation deadline of January 12, 2026, for federal agencies, non-federal organizations must determine their own risk tolerance and patching cadence based on their specific exposure. Residual risk remains if the device is kept in service without verified authorization controls, as other undocumented endpoints may share similar authorization failures.

Source and editorial note

CVE-2023-52163: Digiever DS-2105 Pro Missing Authorization Vulnerability · Source date: December 22, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: December 25, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 25, 2026 at 00:06 UTC.

Request a Vulnerability Assessment