Type Vulnerability
Digiever DS-2105 Pro contains a missing authorisation vulnerability which could allow for command injection via time_tzsetup. Known-exploited catalogue reports exploitation in the wild.
Digiever
Digiever DS-2105 Pro Missing Authorization Vulnerability
CVE-2023-52163
What this means
This is rated high severity (8.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Digiever Ds 2105 Pro Firmware, Digiever Ds 2105 Pro and Digiever Ds 2105 Pro\+ Firmware, and 1 more are in your estate, and treat that as the priority.
Full vendor description
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Scoring and exploitation
8.8/ 10
CVSS 3.1 base scoreHigh
Exploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredLowPR:L
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~96.9% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Digiever DS-2105 Pro
Weaknesses
CWE-862
Affected products ()
- Digiever Ds 2105 Pro Firmware
- Digiever Ds 2105 Pro
- Digiever Ds 2105 Pro\+ Firmware
- Digiever Ds 2105 Pro\+
Show the raw CPE strings (4)
- cpe:2.3:o:digiever:ds-2105_pro_firmware:3.1.0.71-11:*:*:*:*:*:*:*
- cpe:2.3:h:digiever:ds-2105_pro:-:*:*:*:*:*:*:*
- cpe:2.3:o:digiever:ds-2105_pro\+_firmware:3.1.0.71-11:*:*:*:*:*:*:*
- cpe:2.3:h:digiever:ds-2105_pro\+:-:*:*:*:*:*:*:*
References
4 links from the CVE record, grouped by site.
akamai.com1 link
- digiever-fix-that-iot-thing (opens in a new tab)Exploit · Third Party Advisory
txone.com1 link
- digiever-fixes-sorely-needed (opens in a new tab)Exploit · Third Party Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource
fortinet.com1 link
- shadowv2-casts-a-shadow-over-iot-devices (opens in a new tab)Exploit · Third Party Advisory