CVE-2026-87827

Vulnerable KGUARD DVR firmware runs a system command execution service on all network interfaces (0.0.0.0) without requiring authentication, so any remote attacker with network access to the exposed service can execute arbitrary system commands on the device. Full control of the DVR is the outcome, and the Mirai_ptea (Rimasuta) and Mirai_aurora botnets have already leveraged the flaw to propagate and conduct DDoS activity. Affected devices are primarily those running 2016-era firmware across numerous KGUARD models (D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, and the D97xx, D98xx, and D99xx series, across several hardware revisions); firmware released after 2017 mitigates the issue by binding the service to the localhost interface (127.0.0.1). Exploitation is confirmed in the wild in 2026, including via the rapperbot malware family, and this CVE was assigned specifically to document active exploitation given the lack of vendor documentation. The flaw carries a CVSS v4.0 score of 10 (critical), has no known public proof-of-concept, and is not yet in CISA KEV.

What to do: Upgrade affected KGUARD DVRs to firmware released after 2017, which binds the command execution service to 127.0.0.1; where an update is not possible, remove port-forwarding or firewall rules that expose the DVR's service to the internet and restrict access to trusted hosts only. Check whether the command execution service is listening on 0.0.0.0 rather than localhost, and since these devices are being used for DDoS propagation, monitor for suspicious outbound traffic and reboot or quarantine any unit suspected of compromise.