--- title: "Unpatched DigiEver DVRs Under Active Attack by Mirai Botnets" url: https://radicalnotion.ai/blog/unpatched-digiever-dvrs-under-active-attack-by-mirai-botnets-20251228195109 type: article description: "A critical command injection flaw in DigiEver surveillance devices is being actively exploited by multiple botnets. The vendor has refused to patch, leaving thousands of devices permanently vulnerable." updated: 2025-12-29 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Unpatched DigiEver DVRs Under Active Attack by Mirai Botnets By Radical Notion Team, 2025-12-28 *A critical command injection flaw in DigiEver surveillance devices is being actively exploited by multiple botnets. The vendor has refused to patch, leaving thousands of devices permanently vulnerable.* Security cameras designed to protect homes and businesses are being turned into weapons. A critical vulnerability in DigiEver digital video recorders (DVRs) is under active exploitation by at least two Mirai-variant botnets, and the manufacturer has made clear it will never release a fix. For organizations still running these devices, the clock is ticking. --- ## What Happened CVE-2023-52163 is a command injection vulnerability affecting DigiEver DVR devices, including the DS-2105 Pro running firmware version 3.1.0.71-11. The flaw was discovered by security researchers at TXOne Networks in July 2023, who promptly notified DigiEver of the issue. The vendor's response was blunt: the products are End-of-Life (EOL) and have been for five years. No patch would be forthcoming. That decision has had consequences. By December 2023, threat actors had discovered and weaponized the vulnerability. Researchers at Akamai's Security Intelligence Response Team (SIRT) documented active exploitation by a Mirai-type botnet they dubbed "Hail Cock." More recently, Fortinet's FortiGuard Labs has observed a separate botnet called "ShadowV2" leveraging the same flaw to conscript vulnerable DVRs into its army of compromised devices. The vulnerability has since been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, a clear signal to federal agencies and the broader security community that this threat requires immediate attention. CISA's deadline for federal agencies to address the vulnerability is January 12, 2026—though for devices that will never receive a patch, "addressing" effectively means pulling the plug. --- ## Understanding the Vulnerability At its core, CVE-2023-52163 is a textbook command injection vulnerability, the kind security professionals have been warning about for decades. The flaw resides in a CGI script called `time_tzsetup.cgi`, which handles time synchronization settings for the DVR. This script is accessible through a gateway endpoint at `/cgi-bin/cgi_main.cgi`. The vulnerability exists because the script takes user-supplied input from the `ntp` parameter—intended to specify a Network Time Protocol server address—and passes it directly to a system shell command without any sanitization. An attacker can append shell metacharacters such as semicolons (`;`), pipes (`|`), or backticks (`'`) to inject arbitrary commands that the device's operating system will dutifully execute. There is a notable discrepancy in how different researchers classify the authentication requirements for this attack. TXOne Networks, which discovered the vulnerability, describes it as a post-authentication flaw, meaning an attacker would first need valid credentials to access the device's management interface. However, CISA has classified the vulnerability under CWE-862 (Missing Authorization), suggesting the vulnerable script itself may not properly verify that a user is authenticated before processing requests. Fortinet's observations of in-the-wild exploitation appear to confirm that attackers are exploiting this flaw without authentication, potentially by bypassing or ignoring any authentication checks at the gateway level. The practical implication is stark: if a DigiEver DVR's management interface is accessible from the internet, it can likely be compromised with a single HTTP request. ### The Attack Chain The exploitation process is devastatingly simple: 1. **Target Identification**: The attacker scans the internet for DigiEver DVR devices with exposed management interfaces. These devices often use default credentials or have weak passwords, and in many cases, authentication may not even be required to reach the vulnerable endpoint. 2. **Crafted Request**: The attacker sends an HTTP POST request to the `/cgi-bin/cgi_main.cgi` endpoint. The request body contains two critical parameters: 3. **Command Execution**: The device's backend processes the request, extracting the `ntp` parameter value and passing it to a shell command. The shell interprets the semicolon as a command separator and executes the attacker's injected command with the privileges of the web server process. 4. **Malware Deployment**: In observed attacks, threat actors use this initial access to download and execute a shell script (commonly named `binary.sh`) from an attacker-controlled server. This script fetches architecture-specific Mirai malware binaries and installs them on the device, enrolling it into the botnet. ### Detection Rule TXOne Networks has published a Snort 3 rule that can detect exploitation attempts: ```plaintext alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS ( msg:"WEB-CGI Digiever DS-2105 Pro Command Injection"; flow:to_server,established; http_uri; content:"/cgi-bin/cgi_main.cgi"; http_client_body; content:"cgiName=time_tzsetup.cgi"; pcre:"/ntp=[0-9a-zA-Z\\.\\s]*[|`\\;]/"; reference:cve,2023-52163; classtype:web-application-attack; sid:1000001; rev:1; ) ``` This rule looks for POST requests to the vulnerable CGI gateway where the request body contains the `time_tzsetup.cgi` target and an `ntp` parameter followed by shell metacharacters—the telltale signature of an exploitation attempt. --- ## Who Is Affected | | | | | | --- | --- | --- | --- | | | | | | | | | | | | | | | | | DigiEver | DS-2105 Pro | 3.1.0.71-11 (confirmed) | None (EOL) | | DigiEver | DVRs (various models) | Unknown (likely all) | None (EOL) | The full scope of affected products remains unclear, and this ambiguity is itself a significant concern. TXOne researchers noted that DigiEver appears to use a shared codebase across its DVR product line, meaning the vulnerability likely affects far more devices than just the DS-2105 Pro. However, without cooperation from the vendor, a definitive list of affected models and firmware versions cannot be established. DigiEver DVRs are typically deployed in small-to-medium business environments for video surveillance purposes. These devices record and store security camera footage, often containing sensitive visual data of employees, customers, and business operations. They are frequently found in retail locations, small offices, warehouses, and residential properties. The devices are often managed remotely, which unfortunately means their management interfaces are frequently exposed to the internet—either intentionally for convenience or unintentionally due to misconfigured network equipment. This exposure makes them prime targets for automated scanning and exploitation by botnet operators. --- ## Real-World Risk ### Active Exploitation Confirmed This is not a theoretical threat. Multiple security organizations have confirmed active exploitation in the wild: **Hail Cock Botnet**: First documented by Akamai SIRT around December 19, 2023, this Mirai-variant botnet was observed actively scanning for and exploiting CVE-2023-52163 to compromise DigiEver DVRs. The compromised devices are then used to conduct distributed denial-of-service (DDoS) attacks. **ShadowV2 Botnet**: Fortinet's FortiGuard Labs has documented a separate campaign by the ShadowV2 botnet, which also leverages this vulnerability. Their research identified specific infrastructure used by the attackers: - **Command & Control Server**: `silverpath[.]shadowstresser[.]info` - **Malware Hosting IP**: `81[.]88[.]18[.]108` - **Exploitation Source IP**: `198[.]199[.]72[.]27` - **Downloader Script**: `binary.sh` Fortinet has also published SHA256 hashes for ShadowV2 malware samples: - `0408d57c5ded5c79bf1c5b15dfde95547e17b81214dfc84538edcdbef4e61ffe` - `dfaf34b7879d1a6edd46d33e9b3ef07d51121026b8d883fdf8aced630eda2f83` - `6f1a5f394c57724a0f1ea517ae0f87f4724898154686e7bf64c6738f0c0fb7b6` ### Impact Scenarios Successful exploitation of CVE-2023-52163 grants attackers complete control over the compromised DVR. The potential consequences are severe: 1. **Surveillance Compromise**: Attackers can access live video feeds and recorded footage, exposing sensitive visual information about facilities, personnel, and operations. They can also delete or manipulate recordings, potentially covering their tracks or those of physical intruders. 2. **Botnet Conscription**: The most commonly observed exploitation pattern involves enrolling compromised DVRs into botnets for DDoS attacks. These attacks can target any organization on the internet, meaning your compromised DVR could be used to attack banks, hospitals, or government agencies. 3. **Network Pivot Point**: A compromised DVR on an internal network can serve as a beachhead for lateral movement. Attackers can use the device to scan the internal network, harvest credentials, and attack other systems that would otherwise be protected by perimeter defenses. 4. **Credential Theft**: DVRs often store network credentials, camera access passwords, and potentially credentials for other systems. These can be exfiltrated and used for further attacks. The CVSS 3.1 score for this vulnerability is **8.8 (HIGH)**, with the vector string `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. This reflects the network-accessible attack vector, low complexity, and complete impact on confidentiality, integrity, and availability. Some analyses suggest the score should be even higher (9.8) if the vulnerability can be exploited without authentication, as in-the-wild attacks suggest. --- ## What You Should Do The uncomfortable truth is that there is no patch coming for CVE-2023-52163. DigiEver has made clear these products are End-of-Life and will not be updated. Organizations must take alternative action immediately. ### Immediate Actions 1. **Identify Affected Devices**: Conduct an immediate inventory of your network to identify any DigiEver DVR devices. Pay particular attention to devices with internet-facing management interfaces. 2. **Disconnect from the Internet**: The single most effective mitigation is removing these devices from direct internet exposure. If the management interface is not accessible from the internet, remote exploitation becomes impossible. 3. **Change Default Credentials**: If you haven't already, change the default username and password on all DigiEver devices to strong, unique credentials. While this doesn't fix the underlying vulnerability, it raises the bar for exploitation in scenarios where authentication is enforced. ### Network-Level Mitigations 1. **Implement Network Segmentation**: Place DVR devices on an isolated network segment with strict access controls. They should not have unrestricted access to critical internal systems. 2. **Deploy Firewall Rules**: If remote access is absolutely required, implement strict firewall rules that limit access to specific, trusted IP addresses. Better yet, require VPN access with multi-factor authentication before the device can be reached. 3. **Enable Detection Rules**: Deploy the provided Snort detection rule and any relevant IPS signatures to monitor for exploitation attempts: ### Long-Term Remediation 1. **Plan for Replacement**: The only permanent solution is to replace these End-of-Life devices with supported equipment from a vendor that will provide security updates. Begin the procurement process now. 2. **Monitor for Indicators of Compromise**: Review network logs for connections to known malicious infrastructure and unusual outbound traffic patterns from DVR devices. Check for the IOCs listed above. ### Log Analysis Security teams should review web server access logs for exploitation indicators: - HTTP POST requests to `/cgi-bin/cgi_main.cgi` - Request bodies containing `cgiName=time_tzsetup.cgi` - `ntp` parameter values containing shell metacharacters (`|`, `;`, `'`) - Suspicious command strings in the `ntp` parameter --- ## The Bigger Picture CVE-2023-52163 exemplifies a growing crisis in IoT security: the abandoned device problem. When vendors declare products End-of-Life and refuse to issue security patches, customers are left with equipment that will remain vulnerable forever. In this case, DigiEver's products have apparently been EOL for five years, yet they remain deployed in countless environments, quietly recording video while presenting an open door to attackers. The situation is made worse by the nature of DVR deployments. These devices are often installed by third-party contractors or previous IT staff and then forgotten. They sit in closets and server rooms, dutifully recording footage while running ancient, unpatched firmware. When their management interfaces are exposed to the internet—sometimes by design, sometimes by accident—they become easy prey for automated exploitation tools. The addition of CVE-2023-52163 to CISA's Known Exploited Vulnerabilities catalog sends a clear message: this threat is real, it's active, and it requires immediate attention. But for devices that will never be patched, CISA's guidance is unambiguous: "Discontinue use of the product." For organizations that cannot immediately replace affected devices, aggressive network isolation and monitoring are essential. These DVRs should be treated as hostile devices that happen to be inside your network perimeter—because after exploitation, that's exactly what they become. The Mirai botnet and its descendants have demonstrated time and again that insecure IoT devices pose a threat not just to their owners, but to the entire internet. Every compromised DVR is another soldier in an army that can be aimed at any target. The question isn't whether your DigiEver devices will be attacked—it's whether you'll address the vulnerability before or after they're conscripted into a botnet. --- ## Sources - [NVD - CVE-2023-52163](https://nvd.nist.gov/vuln/detail/CVE-2023-52163) - [TXOne Networks Research - DigiEver Fixes Sorely Needed](https://www.txone.com/blog/digiever-fixes-sorely-needed/) - [Akamai SIRT - DigiEver: Fix That IoT Thing](https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing) - [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-52163) - [Fortinet FortiGuard Labs - ShadowV2 Casts a Shadow Over IoT Devices](https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices) Tags: CVE-2023-52163, DigiEver, command-injection, IoT-security, Mirai-botnet, CISA-KEV --- Source: [RadicalNotion.AI](https://radicalnotion.ai/blog/unpatched-digiever-dvrs-under-active-attack-by-mirai-botnets-20251228195109). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.