CVE-2023-52163
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Digiever DS-2105 Pro devices through command injection in the time_tzsetup.cgi endpoint. It affects devices running version 3.1.0.71-11 that are no longer supported by the vendor. Attackers can gain full control of vulnerable devices.
💻 Affected Systems
- Digiever DS-2105 Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent malware, pivot to internal networks, or use devices in botnets for DDoS attacks.
Likely Case
Device takeover for cryptocurrency mining, credential theft, or participation in IoT botnets.
If Mitigated
Limited impact if devices are isolated in separate VLANs with strict network controls.
🎯 Exploit Status
Exploits observed in the wild as part of ShadowV2 botnet campaigns. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available since devices are end-of-life. Consider replacement with supported hardware.
🔧 Temporary Workarounds
Network Isolation
allPlace vulnerable devices in isolated VLAN with strict firewall rules blocking all inbound traffic.
CGI Endpoint Blocking
allBlock access to time_tzsetup.cgi endpoint at network perimeter or device firewall.
🧯 If You Can't Patch
- Immediately disconnect vulnerable devices from internet access
- Implement strict network segmentation with firewall rules blocking all unnecessary traffic
🔍 How to Verify
Check if Vulnerable:
Check device web interface for version 3.1.0.71-11. Attempt to access /cgi-bin/time_tzsetup.cgi endpoint.Check Version:
Check device web interface or use nmap service detectionVerify Fix Applied:
Verify devices are either replaced or network controls prevent access to vulnerable endpoint.📡 Detection & Monitoring
Log Indicators:
- Unusual CGI requests to time_tzsetup.cgi
- Suspicious command execution in system logs
- Unexpected outbound connections
Network Indicators:
- HTTP POST requests to /cgi-bin/time_tzsetup.cgi with shell commands
- Unusual traffic patterns from IoT devices
SIEM Query:
source="device_logs" AND (uri="/cgi-bin/time_tzsetup.cgi" OR command="*sh*" OR command="*bash*")🔗 References
- https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing
- https://www.txone.com/blog/digiever-fixes-sorely-needed/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-52163
- https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices
