CVE-2023-52163 IBM QRadar · QRadar

Detect Digiever DS-2105 Pro Missing Authorization Exploitation (CVE-2023-52163) in IBM QRadar

Detects exploitation of CVE-2023-52163, a missing authorization vulnerability (CWE-862) in Digiever DS-2105 Pro NVR devices. This KEV-listed vulnerability allows unauthenticated attackers to access restricted functionality or administrative interfaces without proper credential validation. Threat actors actively exploit exposed NVR devices for initial access, lateral movement, and persistence in OT/IoT environments.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  COUNT(*) AS request_count,
  COUNT(DISTINCT sourceip) AS unique_sources,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Palo Alto PA Series', 'Cisco ASA', 'Juniper SRX', 'Proxy')
  AND destinationport IN (80, 443, 8080, 8443, 554, 37777)
  AND (
    URL ILIKE '%/cgi-bin/%'
    OR URL ILIKE '%/admin/%'
    OR URL ILIKE '%/system/%'
    OR URL ILIKE '%/config/%'
    OR URL ILIKE '%/setup%'
    OR URL ILIKE '%/api/%'
  )
  AND ("Authorization" NOT IN HEADERS OR HEADERS IS NULL)
  AND DATEFORMAT(starttime, 'YYYY-MM-dd') = DATEFORMAT(NOW(), 'YYYY-MM-dd')
GROUP BY sourceip, destinationip, destinationport, URL
HAVING request_count > 5 OR unique_sources > 2
ORDER BY request_count DESC
LAST 24 HOURS
high severity medium confidence

QRadar AQL query detecting high-volume or multi-source unauthenticated requests to Digiever NVR administrative endpoints, with grouping to surface exploitation campaigns versus isolated probes.

Data Sources

QRadar Network ActivityFirewall log sourcesProxy log sourcesIDS events

Required Tables

events

False Positives & Tuning

  • Scheduled internal monitoring tasks using legacy HTTP clients that strip Authorization headers
  • Network management platforms with misconfigured credential injection for embedded device APIs
  • Penetration testing activity during authorized security assessment windows

Other platforms for CVE-2023-52163

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated Admin Endpoint Enumeration

    Expected signal: HTTP GET requests to /cgi-bin/ and /admin/ paths from the test host IP to the NVR device on port 80, with no Authorization header present in the HTTP request headers

  2. Test 2RTSP Stream Access Without Authentication

    Expected signal: Network connections to TCP/554 (RTSP) and TCP/80 from test host; HTTP requests to /cgi-bin/snapshot.cgi without authentication headers; potential RTSP DESCRIBE request in network capture

  3. Test 3Configuration Extraction via Unauthenticated API

    Expected signal: Multiple HTTP GET requests to configuration and backup endpoints without Authorization headers; file download activity if 200 responses received; DNS lookups for NVR hostname from test system

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the destination IP(s) triggering the alert and confirm whether they correspond to Digiever DS-2105 Pro NVR devices in the asset inventory. Check CMDB and DHCP/DNS records for device registration.
  2. Determine whether the source IP is internal (authorized management host, monitoring system) or external (internet-facing exploitation attempt). Geolocate external IPs and cross-reference against threat intelligence feeds.
  3. Review the specific URL paths accessed. Prioritize paths under /cgi-bin/admin, /system/config, or /setup as these indicate attempts to read or modify device configuration without authentication.
  4. Check HTTP response codes: 200/201 responses to unauthenticated admin requests confirm successful exploitation. 401/403 responses indicate the device may be patched or the path requires different credentials.

Containment

  1. If exploitation is confirmed, immediately isolate the affected NVR device from the network by disabling the switch port or applying an ACL blocking all inbound traffic to the device IP except from authorized management VLANs.
  2. Block the offending source IP(s) at the perimeter firewall and WAF. If the source is external, also null-route at the upstream BGP level if available. Preserve netflow/PCAP data before blocking for forensic use.

Evidence Collection

  1. Capture full PCAP or proxy logs for all sessions from the offending source IP to the NVR device, preserving HTTP request bodies and response payloads to determine what data was accessed or modified.
  2. Export NVR device logs if accessible (syslog forwarding, local log download via admin UI or serial console) to document all configuration changes, user creations, or stream access events during the exploitation window.

Escalation Criteria

  • !Escalate to incident response if HTTP 200 responses were returned to unauthenticated admin requests, indicating successful unauthorized configuration access, credential extraction, or firmware modification.
  • !Escalate immediately if the NVR device monitors physical security-critical areas (server rooms, data centers, executive areas) or if evidence suggests the attacker pivoted from the NVR to adjacent network segments.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >HTTP server access logs on the NVR device showing unauthenticated requests to /cgi-bin/ and /admin/ paths with 200-series response codes
  • >Netflow records showing sustained or repeated TCP connections from an external IP to NVR management ports (80, 443, 8080)
  • >NVR internal configuration database showing unexpected admin account additions, RTSP stream credential changes, or firmware update timestamps
  • >DNS query logs showing reverse lookups or hostname resolution for the NVR IP from unfamiliar internal hosts post-exploitation

Tuning Guidance

Start by suppressing alerts originating from known NVR management hosts (IT ops workstations, monitoring servers) identified in the asset inventory. Build an allowlist of authorized source IPs for each NVR device. Raise the request_count threshold from 5 to 15 if background noise from legacy monitoring tools is high. For environments without Digiever NVRs, disable the detection or restrict it to known NVR IP ranges using a watchlist. Consider adding User-Agent string matching for known Digiever management software to reduce false positives from legitimate vendor tooling.

Hunting Queries

Threat hunt for NVR management interface access patterns across the estate over the past 7 days to identify other potentially exploited devices or reconnaissance activity preceding targeted exploitation

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (80, 443, 8080, 8443, 554, 37777)
| where InitiatingProcessFileName !in ("chrome.exe", "firefox.exe", "msedge.exe", "curl.exe", "wget.exe")
| where RemoteUrl has_any ("/cgi-bin/", "/admin/", "/nvr/", "/system/", "/setup")
| summarize count() by DeviceName, RemoteIP, RemoteUrl, RemotePort
| where count_ > 10
| order by count_ desc
Hunting — SPL
spl 
index=network earliest=-7d
| search dest_port IN (80, 443, 8080, 8443, 554, 37777)
| search uri_path="*/cgi-bin/*" OR uri_path="*/admin/*" OR uri_path="*/nvr/*"
| stats count BY src_ip, dest_ip, uri_path
| where count > 10
| sort - count

Atomic Red Team Tests

Test 1 Unauthenticated Admin Endpoint Enumeration
linux

Simulates an attacker enumerating administrative endpoints on the Digiever DS-2105 Pro without providing any authentication credentials, testing whether the missing authorization check allows access.

Command

bash 
#!/bin/bash
# LAB ONLY — target must be an isolated test NVR device
TARGET_IP="192.168.100.50"
PATHS=("/cgi-bin/admin" "/cgi-bin/system" "/admin/config" "/system/setup" "/api/v1/info" "/cgi-bin/get_status")
for path in "${PATHS[@]}"; do
  echo "[*] Testing: http://${TARGET_IP}${path}"
  curl -s -o /dev/null -w "Path: ${path} | Status: %{http_code} | Size: %{size_download}\n" \
    -H 'User-Agent: Mozilla/5.0' \
    --max-time 5 \
    "http://${TARGET_IP}${path}"
done

Cleanup

bash 
No cleanup required — read-only HTTP GET requests; no state changes made to the device

Expected Telemetry

HTTP GET requests to /cgi-bin/ and /admin/ paths from the test host IP to the NVR device on port 80, with no Authorization header present in the HTTP request headers

Expected Detection

Alert triggers on >5 requests to administrative paths without Authorization header from a single source IP within the 5-minute detection window

Test 2 RTSP Stream Access Without Authentication
linux

Attempts to access RTSP video streams on the NVR without authentication, simulating an attacker exploiting missing authorization to view live camera feeds.

Command

bash 
#!/bin/bash
# LAB ONLY — target must be an isolated test NVR device
TARGET_IP="192.168.100.50"
echo "[*] Attempting unauthenticated RTSP stream access"
# Test RTSP DESCRIBE without credentials
curl -s --max-time 10 \
  -H 'CSeq: 1' \
  -H 'User-Agent: LibVLC/3.0.0' \
  "rtsp://${TARGET_IP}:554/stream1" 2>&1 | head -30
# Also test HTTP-based stream endpoint
curl -s -o /dev/null -w "HTTP Stream Status: %{http_code}\n" \
  --max-time 5 \
  "http://${TARGET_IP}:80/cgi-bin/snapshot.cgi"

Cleanup

bash 
Terminate any lingering curl processes: pkill -f 'curl.*192.168.100.50'

Expected Telemetry

Network connections to TCP/554 (RTSP) and TCP/80 from test host; HTTP requests to /cgi-bin/snapshot.cgi without authentication headers; potential RTSP DESCRIBE request in network capture

Expected Detection

Network detection rules fire on unauthenticated requests to NVR streaming endpoints; RTSP anomaly detection if deployed

Test 3 Configuration Extraction via Unauthenticated API
linux

Simulates post-exploitation configuration extraction by an attacker who has confirmed the missing authorization vulnerability, attempting to download device configuration files without credentials.

Command

bash 
#!/bin/bash
# LAB ONLY — target must be an isolated test NVR device
TARGET_IP="192.168.100.50"
OUTDIR="/tmp/nvr_test_output"
mkdir -p "${OUTDIR}"
CONFIG_PATHS=(
  "/cgi-bin/get_config"
  "/cgi-bin/export_config"
  "/system/config/backup"
  "/admin/backup"
  "/api/v1/system/config"
)
for path in "${CONFIG_PATHS[@]}"; do
  OUTFILE="${OUTDIR}/$(echo ${path} | tr '/' '_').bin"
  HTTP_CODE=$(curl -s -w "%{http_code}" -o "${OUTFILE}" \
    --max-time 10 \
    -H 'User-Agent: Mozilla/5.0' \
    "http://${TARGET_IP}${path}")
  FILE_SIZE=$(wc -c < "${OUTFILE}")
  echo "Path: ${path} | Status: ${HTTP_CODE} | Bytes: ${FILE_SIZE}"
done
echo "[*] Test complete. Output in ${OUTDIR}"

Cleanup

bash 
rm -rf /tmp/nvr_test_output

Expected Telemetry

Multiple HTTP GET requests to configuration and backup endpoints without Authorization headers; file download activity if 200 responses received; DNS lookups for NVR hostname from test system

Expected Detection

Alert on sustained unauthenticated requests to /cgi-bin/ and /system/config paths; DLP alert if configuration data containing credential fields is transferred to non-authorized host

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense Evasion

Related Techniques

T1190Exploit Public-Facing ApplicationT1133External Remote ServicesT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections