CVE-2023-7227 is a command injection flaw in the dynamic DNS settings of SystemK NVR 504, 508 and 516 network video recorders. It scores 9.8 (Critical) and runs commands as root. CISA says the vendor has not responded, so no fix exists to apply. Isolate the devices.
What's affected
Affected: SystemK NVR 504, NVR 508 and NVR 516 running firmware 2.3.5SK.30084998 and prior, per CISA advisory ICSA-24-025-02 and the record.
Fixed: none. CISA states that SystemK has not responded to its requests to work on mitigation, and invites users to contact SystemK customer support. The advisory notes that a public proof of concept exists, and its summary says the flaw is exploitable remotely with low complexity. The record's KEV flag is false, and the advisory does not say it is exploited in the wild.
The weakness is CWE-77, improper neutralization of special elements used in a command. The vector is network reachable, no privileges, no user interaction, with high impact across the board. CISA lists the sector as commercial facilities and the vendor's headquarters as Japan.
How to check if you're exposed
Find every NVR in your inventory, and read the firmware version from the recorder's web interface. If it shows 2.3.5SK.30084998 or an earlier build on a 504, 508 or 516, it is in scope.
Then test exposure. Recorders are often published to the internet so staff can watch cameras remotely. From outside your network, check whether the recorder's web port answers on your public address, and check your router for port forwards pointing at it.
What to do now
- Remove any direct internet exposure of the recorder. Delete port forwards and disable UPnP on the router.
- Place the recorders on a separate network segment that only trusted workstations can reach.
- If remote viewing is needed, use a VPN that you keep patched, and not a published port.
- Contact SystemK support as CISA suggests, and ask for fixed firmware in writing.
- Review the DDNS settings on each device for values you did not set, and change admin passwords.
- Plan to replace the recorders if the vendor stays silent.
Why it matters
Command injection happens when a device builds an operating system command from a setting and does not neutralize special characters first. A DDNS field looks harmless, since it holds a hostname, but if the value ends up in a shell command, the person who controls it controls the command. Because the device runs that command as root, the result is full control.
Network video recorders are attractive because they sit on the same network as other equipment, run for years without updates, and often have default or shared passwords. With no vendor fix, the strongest control is to keep the device from being reachable at all.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a firmware fix for CVE-2023-7227?
Not according to CISA, which says the vendor did not respond to its requests. Ask SystemK support directly.
Is it exploited in the wild?
The advisory says a public proof of concept exists. The record's KEV flag is false, and I found no statement of active exploitation.
Sources
Last reviewed: 19 October 2026.
