Unpatched DigiEver DVRs Under Active Attack by Mirai Botnets

Understanding the Vulnerability

At its core, CVE-2023-52163 is a textbook command injection vulnerability, the kind security professionals have been warning about for decades. The flaw resides in a CGI script called time_tzsetup.cgi, which handles time synchronization settings for the DVR. This script is accessible through a gateway endpoint at /cgi-bin/cgi_main.cgi.

The vulnerability exists because the script takes user-supplied input from the ntp parameter—intended to specify a Network Time Protocol server address—and passes it directly to a system shell command without any sanitization. An attacker can append shell metacharacters such as semicolons (;), pipes (|), or backticks (`) to inject arbitrary commands that the device's operating system will dutifully execute.

There is a notable discrepancy in how different researchers classify the authentication requirements for this attack. TXOne Networks, which discovered the vulnerability, describes it as a post-authentication flaw, meaning an attacker would first need valid credentials to access the device's management interface. However, CISA has classified the vulnerability under CWE-862 (Missing Authorization), suggesting the vulnerable script itself may not properly verify that a user is authenticated before processing requests. Fortinet's observations of in-the-wild exploitation appear to confirm that attackers are exploiting this flaw without authentication, potentially by bypassing or ignoring any authentication checks at the gateway level.

The practical implication is stark: if a DigiEver DVR's management interface is accessible from the internet, it can likely be compromised with a single HTTP request.

The Attack Chain

The exploitation process is devastatingly simple:

1. Target Identification: The attacker scans the internet for DigiEver DVR devices with exposed management interfaces. These devices often use default credentials or have weak passwords, and in many cases, authentication may not even be required to reach the vulnerable endpoint.
2. Crafted Request: The attacker sends an HTTP POST request to the /cgi-bin/cgi_main.cgi endpoint. The request body contains two critical parameters:
3. Command Execution: The device's backend processes the request, extracting the ntp parameter value and passing it to a shell command. The shell interprets the semicolon as a command separator and executes the attacker's injected command with the privileges of the web server process.
4. Malware Deployment: In observed attacks, threat actors use this initial access to download and execute a shell script (commonly named binary.sh) from an attacker-controlled server. This script fetches architecture-specific Mirai malware binaries and installs them on the device, enrolling it into the botnet.

Detection Rule

TXOne Networks has published a Snort 3 rule that can detect exploitation attempts:

This rule looks for POST requests to the vulnerable CGI gateway where the request body contains the time_tzsetup.cgi target and an ntp parameter followed by shell metacharacters—the telltale signature of an exploitation attempt.

Who Is Affected

The full scope of affected products remains unclear, and this ambiguity is itself a significant concern. TXOne researchers noted that DigiEver appears to use a shared codebase across its DVR product line, meaning the vulnerability likely affects far more devices than just the DS-2105 Pro. However, without cooperation from the vendor, a definitive list of affected models and firmware versions cannot be established.

DigiEver DVRs are typically deployed in small-to-medium business environments for video surveillance purposes. These devices record and store security camera footage, often containing sensitive visual data of employees, customers, and business operations. They are frequently found in retail locations, small offices, warehouses, and residential properties.

The devices are often managed remotely, which unfortunately means their management interfaces are frequently exposed to the internet—either intentionally for convenience or unintentionally due to misconfigured network equipment. This exposure makes them prime targets for automated scanning and exploitation by botnet operators.

Real-World Risk

Active Exploitation Confirmed

This is not a theoretical threat. Multiple security organizations have confirmed active exploitation in the wild:

Hail Cock Botnet: First documented by Akamai SIRT around December 19, 2023, this Mirai-variant botnet was observed actively scanning for and exploiting CVE-2023-52163 to compromise DigiEver DVRs. The compromised devices are then used to conduct distributed denial-of-service (DDoS) attacks.

ShadowV2 Botnet: Fortinet's FortiGuard Labs has documented a separate campaign by the ShadowV2 botnet, which also leverages this vulnerability. Their research identified specific infrastructure used by the attackers:

• Command & Control Server: silverpath[.]shadowstresser[.]info
• Malware Hosting IP: 81[.]88[.]18[.]108
• Exploitation Source IP: 198[.]199[.]72[.]27
• Downloader Script: binary.sh

Fortinet has also published SHA256 hashes for ShadowV2 malware samples:

• 0408d57c5ded5c79bf1c5b15dfde95547e17b81214dfc84538edcdbef4e61ffe
• dfaf34b7879d1a6edd46d33e9b3ef07d51121026b8d883fdf8aced630eda2f83
• 6f1a5f394c57724a0f1ea517ae0f87f4724898154686e7bf64c6738f0c0fb7b6

Impact Scenarios

Successful exploitation of CVE-2023-52163 grants attackers complete control over the compromised DVR. The potential consequences are severe:

1. Surveillance Compromise: Attackers can access live video feeds and recorded footage, exposing sensitive visual information about facilities, personnel, and operations. They can also delete or manipulate recordings, potentially covering their tracks or those of physical intruders.
2. Botnet Conscription: The most commonly observed exploitation pattern involves enrolling compromised DVRs into botnets for DDoS attacks. These attacks can target any organization on the internet, meaning your compromised DVR could be used to attack banks, hospitals, or government agencies.
3. Network Pivot Point: A compromised DVR on an internal network can serve as a beachhead for lateral movement. Attackers can use the device to scan the internal network, harvest credentials, and attack other systems that would otherwise be protected by perimeter defenses.
4. Credential Theft: DVRs often store network credentials, camera access passwords, and potentially credentials for other systems. These can be exfiltrated and used for further attacks.

The CVSS 3.1 score for this vulnerability is 8.8 (HIGH), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This reflects the network-accessible attack vector, low complexity, and complete impact on confidentiality, integrity, and availability. Some analyses suggest the score should be even higher (9.8) if the vulnerability can be exploited without authentication, as in-the-wild attacks suggest.

What You Should Do

The uncomfortable truth is that there is no patch coming for CVE-2023-52163. DigiEver has made clear these products are End-of-Life and will not be updated. Organizations must take alternative action immediately.

Immediate Actions

1. Identify Affected Devices: Conduct an immediate inventory of your network to identify any DigiEver DVR devices. Pay particular attention to devices with internet-facing management interfaces.
2. Disconnect from the Internet: The single most effective mitigation is removing these devices from direct internet exposure. If the management interface is not accessible from the internet, remote exploitation becomes impossible.
3. Change Default Credentials: If you haven't already, change the default username and password on all DigiEver devices to strong, unique credentials. While this doesn't fix the underlying vulnerability, it raises the bar for exploitation in scenarios where authentication is enforced.

Network-Level Mitigations

1. Implement Network Segmentation: Place DVR devices on an isolated network segment with strict access controls. They should not have unrestricted access to critical internal systems.
2. Deploy Firewall Rules: If remote access is absolutely required, implement strict firewall rules that limit access to specific, trusted IP addresses. Better yet, require VPN access with multi-factor authentication before the device can be reached.
3. Enable Detection Rules: Deploy the provided Snort detection rule and any relevant IPS signatures to monitor for exploitation attempts:

Long-Term Remediation

1. Plan for Replacement: The only permanent solution is to replace these End-of-Life devices with supported equipment from a vendor that will provide security updates. Begin the procurement process now.
2. Monitor for Indicators of Compromise: Review network logs for connections to known malicious infrastructure and unusual outbound traffic patterns from DVR devices. Check for the IOCs listed above.

Log Analysis

Security teams should review web server access logs for exploitation indicators:

• HTTP POST requests to /cgi-bin/cgi_main.cgi
• Request bodies containing cgiName=time_tzsetup.cgi
• ntp parameter values containing shell metacharacters (|, ;, `)
• Suspicious command strings in the ntp parameter

The Bigger Picture

CVE-2023-52163 exemplifies a growing crisis in IoT security: the abandoned device problem. When vendors declare products End-of-Life and refuse to issue security patches, customers are left with equipment that will remain vulnerable forever. In this case, DigiEver's products have apparently been EOL for five years, yet they remain deployed in countless environments, quietly recording video while presenting an open door to attackers.

The situation is made worse by the nature of DVR deployments. These devices are often installed by third-party contractors or previous IT staff and then forgotten. They sit in closets and server rooms, dutifully recording footage while running ancient, unpatched firmware. When their management interfaces are exposed to the internet—sometimes by design, sometimes by accident—they become easy prey for automated exploitation tools.

The addition of CVE-2023-52163 to CISA's Known Exploited Vulnerabilities catalog sends a clear message: this threat is real, it's active, and it requires immediate attention. But for devices that will never be patched, CISA's guidance is unambiguous: "Discontinue use of the product."

For organizations that cannot immediately replace affected devices, aggressive network isolation and monitoring are essential. These DVRs should be treated as hostile devices that happen to be inside your network perimeter—because after exploitation, that's exactly what they become.

The Mirai botnet and its descendants have demonstrated time and again that insecure IoT devices pose a threat not just to their owners, but to the entire internet. Every compromised DVR is another soldier in an army that can be aimed at any target. The question isn't whether your DigiEver devices will be attacked—it's whether you'll address the vulnerability before or after they're conscripted into a botnet.