CVE-2023-52163highunder attackCWE-862

CVE-2023-52163

Published · Updated

Follow this CVE+ Monitor DS-2105 Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

88Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 97%
from disclosure to weapon
Published on NVDFeb 3
CISA KEV+322d
Action required by CISAfederal deadline: 2026-01-12

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A vulnerability in Digiever DS-2105 Pro allows attackers to execute arbitrary commands through the time_tzsetup.cgi file. This affects unsupported versions of the device and could let someone take complete control of the system.

Technical detail

CWE-862 (Missing Authorization) combined with command injection in time_tzsetup.cgi allows unauthenticated or low-privileged attackers to execute arbitrary system commands on affected Digiever DS-2105 Pro devices (version 3.1.0.71-11). The vulnerability exists in an unsupported product line with no available patches.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a