Historical catalog analysis: CISA added this entry on December 22, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2023-52163 is a missing authorization vulnerability (CWE-862) identified in the Digiever DS-2105 Pro. The flaw exists within the time_tzsetup.cgi component, which could potentially allow an attacker to perform command injection. This type of vulnerability occurs when a system fails to properly verify if a user has the necessary permissions to access a specific function or execute a command.
Exposure and applicability
This vulnerability applies specifically to the Digiever DS-2105 Pro. In industrial contexts, these devices are typically deployed as part of physical security infrastructure, surveillance, and building automation systems. Because these systems often monitor critical perimeters or sensitive operational areas, an unauthorized command injection could compromise the integrity of the monitoring environment.
Asset owners should verify if this specific model is integrated into their OT network or physical security VLANs. The risk is most acute for devices exposed to networks where unauthorized users may have reachability to the device’s web management interface.
Remediation priorities
Based on our analysis, we recommend the following prioritized actions for OT security leaders and plant managers:
- Inventory Verification: Identify all instances of the Digiever DS-2105 Pro within the environment. This is a prerequisite for any remediation effort.
- Vendor Mitigation Application: Consult the vendor’s official support documentation to apply available mitigations. If no mitigation is provided or applicable, asset owners should evaluate whether to discontinue use of the product.
- Network Segmentation: As a compensating control to limit potential impact, ensure that surveillance and building automation hardware are isolated from primary process control networks (Purdue Level 2/3) and restricted from general corporate IT access.
- Cloud Service Review: For organizations utilizing cloud-integrated versions of these services, review configurations against established security guidance for cloud-managed OT assets.
How to validate remediation
Validation should be conducted through a combination of administrative and network-level checks:
* Version/Patch Audit: Confirm that the firmware or configuration changes recommended by the vendor have been applied across all identified units.
* Access Control Verification: Use authorized network mapping tools to verify that the management interface of the device is only accessible from designated, secure administrative workstations.
Note: We do not recommend active vulnerability scanning or attempting to trigger the command injection on production equipment, as this could lead to device instability or operational downtime.
Limits and open questions
It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, while CISA has provided a deadline for federal agencies (January 12, 2026), this date is not a legal requirement for private industrial operators but serves as a benchmark for urgency.
Users should be aware that applying a mitigation may not eliminate all residual risks associated with the device’s overall architecture. The effectiveness of any fix depends on the specific nature of the vendor’s provided update.
Source and editorial note
CVE-2023-52163: Digiever DS-2105 Pro Missing Authorization Vulnerability · Source date: December 22, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: December 25, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 10, 2026 at 01:39 UTC.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗