Digiever｜NVR - Exposure of Sensitive Information
Priority MEDIUM 49CWE-497Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-497.
Summary
Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remoter attackers to access the system configuration file and obtain plaintext credentials of the NVR and its connected cameras.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.005 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Digiever | DS-1200 | all versions | — | No fix listed | CNA |
| Digiever | DS-2100 Pro | all versions | — | No fix listed | CNA |
| Digiever | DS-2100 Pro+ | all versions | — | No fix listed | CNA |
| Digiever | DS-2100 UHD | all versions | — | No fix listed | CNA |
| Digiever | DS-2200 UHD | all versions | — | No fix listed | CNA |
| Digiever | DS-2200 UHD+ | all versions | — | No fix listed | CNA |
| Digiever | DS-4200 Pro | all versions | — | No fix listed | CNA |
| Digiever | DS-4200 Pro+ | up to x.x.x.78 | — | No fix listed | CNA |
| Digiever | DS-4200 UHD | up to x.x.x.78 | — | No fix listed | CNA |
| Digiever | DS-4200 UHD+ | up to x.x.x.78 | — | No fix listed | CNA |
| Digiever | DS-4100-RM | up to x.x.x.78 | — | No fix listed | CNA |
| Digiever | DS-4200-RM Pro+ | up to x.x.x.78 | — | No fix listed | CNA |
| Digiever | DS-4200-RM UHD | up to x.x.x.78 | — | No fix listed | CNA |
| Digiever | DS-8x00-RM Pro+ | up to x.x.x.78 | — | No fix listed | CNA |
| Digiever | DS-8x00-SRM Pro+ | up to x.x.x.78 | — | No fix listed | CNA |
| Digiever | DS-8x00-RM UHD | up to x.x.x.78 | — | No fix listed | CNA |
| Digiever | DS-16x00-RM Pro+ | up to x.x.x.78 | — | No fix listed | CNA |
| Digiever | DS-16x00-RM UHD | up to x.x.x.78 | — | No fix listed | CNA |
- DS-1200 VendorDigiever Affected all versions Fixed in — No fix listed CNA
- DS-2100 Pro VendorDigiever Affected all versions Fixed in — No fix listed CNA
- DS-2100 Pro+ VendorDigiever Affected all versions Fixed in — No fix listed CNA
- DS-2100 UHD VendorDigiever Affected all versions Fixed in — No fix listed CNA
- DS-2200 UHD VendorDigiever Affected all versions Fixed in — No fix listed CNA
- DS-2200 UHD+ VendorDigiever Affected all versions Fixed in — No fix listed CNA
- DS-4200 Pro VendorDigiever Affected all versions Fixed in — No fix listed CNA
- DS-4200 Pro+ VendorDigiever Affected up to x.x.x.78 Fixed in — No fix listed CNA
- DS-4200 UHD VendorDigiever Affected up to x.x.x.78 Fixed in — No fix listed CNA
- DS-4200 UHD+ VendorDigiever Affected up to x.x.x.78 Fixed in — No fix listed CNA
- DS-4100-RM VendorDigiever Affected up to x.x.x.78 Fixed in — No fix listed CNA
- DS-4200-RM Pro+ VendorDigiever Affected up to x.x.x.78 Fixed in — No fix listed CNA
- DS-4200-RM UHD VendorDigiever Affected up to x.x.x.78 Fixed in — No fix listed CNA
- DS-8x00-RM Pro+ VendorDigiever Affected up to x.x.x.78 Fixed in — No fix listed CNA
- DS-8x00-SRM Pro+ VendorDigiever Affected up to x.x.x.78 Fixed in — No fix listed CNA
- DS-8x00-RM UHD VendorDigiever Affected up to x.x.x.78 Fixed in — No fix listed CNA
- DS-16x00-RM Pro+ VendorDigiever Affected up to x.x.x.78 Fixed in — No fix listed CNA
- DS-16x00-RM UHD VendorDigiever Affected up to x.x.x.78 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-10264
- 2026-10-03 Alias added: GHSA-2rc6-q82p-3g36
References
More Digiever vulnerabilities
- TI-2023-28597 Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. KEVCVSS 3.1HIGH 8.8
- TI-2025-09421 Digiever｜NVR - OS Command Injection CVSS 4.0HIGH 8.7
Sources
- CVE-2025-10264 · CVE Program
- CVE-2025-10264 · NVD
- FIRST EPSS
- GHSA-2rc6-q82p-3g36 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences