Is CVE-2023-52163 (Digiever DS-2105 Pro Missing Authorization) being exploited in the wild?

Yes. CISA added CVE-2023-52163 to its Known Exploited Vulnerabilities catalogue on 22 December 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi. Any organisation running the affected product should treat remediation as urgent.

What “being exploited in the wild” means for CVE-2023-52163

For a CVE like this, “in the wild” is not just a theory about exploitability, it means there is credible evidence of active abuse against real targets. That shifts the issue from routine patch planning to urgent exposure management, because the vulnerable product can be targeted before an ordinary maintenance window arrives.

For Digiever DS-2105 Pro, the practical question is whether the product is present anywhere in your environment and whether the vulnerable management path is reachable. If it is internet-facing, externally reachable from trusted networks, or exposed through shared administrative access, treat it as a live risk rather than a deferred hardening item.

When a flaw is already being exploited, the operational priority is no longer abstract vulnerability scoring. The immediate task is to confirm exposure, narrow access, and apply the vendor fix or mitigation path described in the CISA Known Exploited Vulnerabilities Catalog and the vendor advisory, rather than waiting for internal prioritisation cycles to settle.

What to check before you assume the device is safe

Start with asset confirmation. Many exploited edge and appliance issues persist because teams know the brand but not the exact deployment footprint, so the first step is to verify where Digiever DS-2105 Pro exists, who administers it, and whether the affected interface is reachable from user networks, partner networks, or the public internet.

Next, look for configuration and access conditions that make the vulnerability easier to reach, including exposed administration interfaces, weak network segmentation, shared admin credentials, and any automated management path that can invoke the vulnerable CGI endpoint. Those are the conditions that often turn a product vulnerability into an incident.

Finally, validate whether the system has already shown signs of abuse. For appliances and embedded devices, that usually means reviewing web access logs, authentication logs, command execution traces where available, unusual configuration changes, and outbound connections that do not match normal device behaviour.

How to respond when patching or mitigation must wait

If you cannot remediate immediately, reduce the attack surface first. Restrict management access to trusted administrative sources, isolate the device from the internet if business use allows it, and remove any unnecessary exposure of the vulnerable function. If the device supports compensating controls, use them now rather than waiting for a scheduled change window.

Then make the blast radius smaller. Limit which identities can administer the appliance, review whether any privileged credentials used to manage it are reused elsewhere, and rotate them if you have evidence the device was exposed or touched. If the product is in a sensitive network segment, assume compromise can have downstream impact beyond the appliance itself.

Where the vendor fix is available, follow the vendor advisory for version-specific remediation and do not rely on informal guidance alone. Where the fix is not yet possible, document the exception, assign an expiry date, and treat the exposure as an active security debt item until the device is brought onto a safe build or retired.

Risk and Threat Considerations

Actively exploited appliance flaws matter because they compress the defender’s timeline. Once a vulnerability is known to be under real-world attack, the main risk is not only compromise of the device itself, but also its use as a foothold into the surrounding network, especially where the device has trusted administrative reach or sits near operational systems.

Failure mechanism: Missing authorization can let an attacker reach privileged functionality through a request path that should have been blocked, and on an appliance that often becomes a stepping stone to command injection, configuration tampering, or further internal access.

Impact: The likely outcomes are device takeover, persistence, exposure of administrative functions, and possible lateral movement if the appliance is trusted by adjacent systems or users.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require rapid identification, prioritization and remediation.
Recommendation — Prioritize exposed appliances for immediate remediation and verify closure.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Recorded	This CVE answer hinges on confirming where the vulnerable product exists and is reachable.
	RS.MA-1 — Mitigation Is Executed	Active exploitation makes rapid containment and remediation the key response action.
Recommendation — Identify and record every exposed Digiever instance before remediation. Execute containment or mitigation as soon as exploitation is confirmed.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The subject is an exploited vulnerability that must be found, tracked and acted on quickly.
	SI-2 — Flaw Remediation	The answer requires urgent repair or mitigation of an actively exploited flaw.
Recommendation — Scan for affected devices and verify remediation status without delay. Apply the vendor fix or approved mitigation path immediately.

Practitioner Guidance

What to prioritise: Confirm whether any instance of Digiever DS-2105 Pro is exposed, reachable, or administratively accessible, then move immediately to remediation or isolation rather than waiting for a broader patch cycle.

What to verify: Check whether access logs, admin activity, or configuration history show requests to the vulnerable path, unexpected parameter values, new admin actions, or changes that were not part of normal maintenance.

Decision rule: If the device is internet-facing or used in a high-trust segment, treat exposure as urgent even before you have proof of compromise; if there is evidence of abuse, rotate any related administrative credentials and investigate the surrounding network, not just the appliance.

Practitioner takeaway: For exploited appliance CVEs, speed matters more than perfect certainty, because the practical question is whether an attacker can still reach the vulnerable path today.