Loading story…
A critical missing authorization vulnerability, tracked as CVE-2023-52163, has been identified in Digiever DS-2105 Pro network video recorders and added to CISA's Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation. This flaw allows attackers to execute unauthorized commands via the time_tzsetup—cgi interface, potentially enabling them to bypass authentication, inject malicious commands, and compromise surveillance systems. The vulnerability is classified under CWE-862 (Missing Authorization) and poses significant risks to organizations using these devices, including the possibility of manipulating video feeds, establishing persistent access, or pivoting into broader network environments. Federal Civilian Executive Branch (FCEB) agencies are required to remediate this vulnerability by January 12, 2026, in accordance with Binding Operational Directive 22-01.
CISA strongly urges all organizations, not just federal agencies, to prioritize remediation of this vulnerability to reduce exposure to cyberattacks. Digiever network video recorders are widely deployed across enterprises, government facilities, and critical infrastructure, increasing the potential impact of exploitation. Organizations are advised to apply available security patches, implement network segmentation, and discontinue use of unpatchable devices. While specific attack campaigns leveraging this vulnerability have not been disclosed, the active exploitation status underscores the urgency for immediate mitigation efforts.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Under Binding Operational Directive 22-01, CISA required Federal Civilian Executive Branch agencies to remediate or otherwise address CVE-2023-52163 by the specified due date. Multiple reports state the deadline as January 12, 2026.
CISA added CVE-2023-52163 in Digiever DS-2105 Pro devices to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The agency warned the flaw poses significant risk, especially because affected products are end-of-life and lack vendor patches.
CVE-2023-52163, a missing authorization and command injection vulnerability in Digiever DS-2105 Pro NVRs, was observed being actively exploited in the wild. Reporting indicates attackers have used the flaw to compromise devices and deliver botnets such as Mirai and ShadowV2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a high-severity command injection vulnerability in Smartbedded Meteobridge devices, tracked as CVE-2025-4008, and added it to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. This vulnerability, with a CVSS score of 8.7, resides in the Meteobridge web interface, specifically within the publicly accessible 'template.cgi' script, which is written in CGI shell scripts and C. The flaw allows remote, unauthenticated attackers to execute arbitrary commands with root privileges by sending specially crafted GET requests to the vulnerable endpoint. Security researchers from ONEKEY discovered that the vulnerability stems from insecure use of eval calls in the CGI script, enabling attackers to inject commands without any authentication or custom headers. The attack can be triggered simply by enticing a victim to visit a malicious webpage or by directly targeting exposed devices, as the CGI script is accessible without authentication. CISA’s advisory highlights that this vulnerability is being actively exploited in the wild, although no detailed public reports of exploitation techniques have been released. The vulnerability was addressed by Smartbedded in Meteobridge version 6.2, released on May 13, 2025, and users are strongly urged to update to this version to mitigate the risk. CISA’s inclusion of CVE-2025-4008 in the KEV catalog mandates that Federal Civilian Executive Branch (FCEB) agencies remediate the vulnerability by a specified due date, as per Binding Operational Directive (BOD) 22-01. The directive also encourages all organizations, not just federal agencies, to prioritize patching of KEV-listed vulnerabilities to reduce exposure to cyberattacks. The vulnerability is considered a significant risk to both federal and enterprise environments due to its ease of exploitation and the potential for attackers to gain full control of affected devices. Alongside Meteobridge, CISA’s recent KEV catalog update also included critical vulnerabilities in products from GNU Bash, Juniper, Samsung, and Jenkins, underscoring the ongoing threat posed by actively exploited flaws. The technical details provided by security researchers demonstrate that exploitation does not require advanced skills, increasing the urgency for immediate remediation. Organizations using Meteobridge devices should verify their firmware version and apply the latest updates without delay. The public advisories and catalog updates serve as a warning to the broader cybersecurity community about the importance of monitoring and addressing vulnerabilities that are known to be under active attack. Failure to remediate CVE-2025-4008 could result in unauthorized access, data compromise, or further exploitation within affected networks. CISA continues to monitor and update the KEV catalog as new evidence of exploitation emerges, reinforcing the need for proactive vulnerability management.
Jun 29, 2026
Cisco released fixes for a **critical remote code execution** vulnerability in Unified Communications and *Webex Calling Dedicated Instance*, tracked as **CVE-2026-20045**, after it was **actively exploited as a zero-day**. The issue stems from **improper validation of user-supplied input in HTTP requests** to the web-based management interface; successful exploitation can provide **user-level OS access** and enable **privilege escalation to root**. Affected products include **Cisco Unified Communications Manager (Unified CM)**, **Unified CM Session Management Edition (SME)**, **Unified CM IM & Presence**, **Cisco Unity Connection**, and **Webex Calling Dedicated Instance**; Cisco provided version-specific remediations including fixed releases and `.cop` patch files (e.g., `ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512`). CISA added **CVE-2026-20045** to its **Known Exploited Vulnerabilities (KEV) Catalog**, citing evidence of active exploitation and highlighting code injection flaws as a common attack vector with significant risk to the federal enterprise. Under **Binding Operational Directive (BOD) 22-01**, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by the specified due date, and CISA urged all organizations to similarly prioritize patching to reduce exposure to ongoing attacks.
Jul 23, 2026
A critical vulnerability, tracked as CVE-2025-13607, has been identified in multiple CCTV camera products, including those from D-Link India Limited, Sparsh Securitech, and Securus CCTV. The flaw arises from missing authentication for a critical function, allowing remote attackers to access sensitive camera configuration data and administrative account credentials simply by exploiting a vulnerable URL endpoint. The vulnerability is network-accessible, requires no user interaction or special privileges, and has been assigned a CVSS v4 score of 9.3 and CVSS v3 score of 9.4, indicating its severe risk to surveillance infrastructure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding this issue, and D-Link has released security updates for affected devices, urging immediate patching and verification of firmware versions. Successful exploitation of this vulnerability could enable attackers to hijack video feeds, steal credentials, and potentially compromise entire surveillance systems. The D-Link DCS-F5614-L1 camera model running firmware versions v1.03.038 and earlier is confirmed to be affected, while other models from Sparsh Securitech and Securus CCTV may also be vulnerable. Organizations using these products are strongly advised to apply available patches and review their camera deployments for exposure. The flaw's trivial exploitation path and the sensitive nature of the data at risk make prompt remediation critical for maintaining the integrity and confidentiality of video surveillance operations.
Jun 29, 2026