A Widely Used Surveillance Device Is Under Active Attack — Authorities Urge Immediate Action

CISA has warned that attackers are actively exploiting a critical vulnerability in Digiever network video recorders.

The Cybersecurity and Infrastructure Security Agency has added a critical vulnerability affecting Digiever Network Video Recorder (NVR) devices to its Known Exploited Vulnerabilities (KEV) catalog, confirming that attackers are actively abusing the flaw in real-world attacks.

The vulnerability allows remote code execution, which means attackers can take full control of affected NVR devices without authentication. Once compromised, attackers can execute arbitrary commands, manipulate video feeds, install malware, or use the devices as entry points into internal networks. As a result, organizations using vulnerable systems face both surveillance and broader network security risks.

Why the Digiever NVR Flaw Is Dangerous

Digiever NVRs often operate as always-on devices connected directly to internal networks. Many organizations expose them to the internet for remote monitoring. Attackers exploit this exposure by scanning for vulnerable systems and executing malicious commands remotely.

Because these devices typically lack advanced endpoint protection, attackers can maintain persistence with little resistance. In some cases, compromised NVRs may serve as footholds for lateral movement, botnet activity, or data exfiltration. Consequently, what appears to be a single device flaw can escalate into a full network compromise.

What Organizations Should Do Now

CISA requires U.S. federal agencies to apply mitigations or updates within a defined timeline. Private organizations should follow the same urgency. Security teams should immediately patch affected Digiever devices or disconnect them from external access if patching is not possible.

Experts also recommend reviewing logs for suspicious activity, restricting network access to surveillance systems, and placing NVR devices on isolated network segments. Without these steps, attackers may continue exploiting exposed systems at scale.

This alert reinforces a familiar but critical lesson. Internet-connected devices, especially surveillance infrastructure, remain attractive targets for attackers. Timely patching and network segmentation remain essential defenses against exploitation.