CVE-2026-87827 in DVR Firmware
Summary
by MITRE • 09/09/2026
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR.
The vulnerability is known to have been exploited in the wild by the Mirai_ptea (Rimasuta) and Mirai_aurora botnets for malware propagation and subsequent DDoS activity. The vulnerability was reported to affect firmware dating from 2016, while firmware released after 2017 appears to mitigate the issue by restricting the affected service to the localhost interface (127.0.0.1) instead of exposing it on all interfaces (0.0.0.0).
The affected-device list reported by Netlab includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants and several associated hardware revisions
The exploit is included in some version of rapperbot and exploited in 2026. This assignment has been made to document the active exploitation and lack of documentation from the vendor.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
A critical remote code execution vulnerability exists within specific firmware versions of KGUARD Digital Video Recorder devices, allowing unauthenticated attackers to execute arbitrary system commands with root-level privileges. The core technical flaw stems from a misconfiguration in network service binding where an administrative command execution interface is exposed on all available network interfaces rather than being restricted to the local loopback address. This architectural oversight effectively bypasses any potential perimeter security controls since the vulnerable service listens on 0.0.0.0, making it accessible to any host with network connectivity to the device. The absence of authentication mechanisms for this specific endpoint means that no credentials are required to interact with the command execution functionality, creating a direct path for remote exploitation by any actor who can reach the target over the network.
The operational impact of this vulnerability is severe, leading to complete compromise of the affected DVR hardware. Once an attacker gains access through this unauthenticated entry point, they achieve full control over the underlying operating system running on the device. This level of access allows for the installation of persistent malware, modification of surveillance footage, exfiltration of sensitive video data, and the use of the compromised device as a pivot point to attack other systems within the local network segment. The vulnerability has been actively exploited in the wild by known botnets such as Mirai_ptea also referred to as Rimasuta and Mirai_aurora which utilize this flaw for malware propagation and subsequent distributed denial-of-service attacks against third-party targets. These campaigns demonstrate that threat actors have integrated automated exploitation scripts into their infrastructure, turning vulnerable IoT devices into nodes within large-scale botnets designed to generate massive traffic volumes or distribute additional malicious payloads like rapperbot variants.
Historical analysis indicates that this vulnerability has been present in firmware versions dating back to 2016, suggesting a long-standing oversight in the vendor's secure development lifecycle. Evidence suggests that firmware releases after 2017 attempted to mitigate the issue by binding the affected service exclusively to the localhost interface at address 127.0.0.1, thereby preventing remote access from external networks. However, numerous devices running older or unpatched firmware remain in active deployment across various models including D1004NR, D1008NR, D1016NR, D1104 variants, D1132NR, D2116NR, and the entire D97xx through D99xx series. The persistence of these vulnerable devices in production environments highlights a significant gap between vendor remediation efforts and actual field deployment practices. Furthermore, recent exploitation activity documented in 2026 involving rapperbot variants underscores that despite known risks for nearly a decade, many organizations have failed to update or replace legacy surveillance infrastructure, leaving them exposed to ongoing automated attacks.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection and CWE-284 Improper Access Control which describes the failure to restrict access to resources for unauthorized actors. In terms of adversary tactics, it maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter allowing attackers to execute commands via shell or script interfaces and potentially T1190 Exploit Public-Facing Application as the entry vector is a service exposed on public-facing network segments. The lack of vendor documentation regarding this specific flaw exacerbates the risk, as administrators may not be aware that their devices are susceptible even if they believe standard security measures like firewalls should provide adequate protection against internal threats or misconfigured services.
Mitigation strategies must prioritize immediate isolation and patching where possible. Organizations operating KGUARD DVRs should first verify whether any of these specific models are present in their infrastructure by consulting the detailed device list provided by threat intelligence sources such as Netlab. For devices running vulnerable firmware, the most effective remediation is to upgrade to a patched version that restricts administrative services to localhost only if available from the vendor. In cases where patching is not feasible due to end-of-life status or lack of updates, network segmentation becomes critical; these devices should be placed in isolated VLANs with strict firewall rules blocking all inbound traffic except for necessary management protocols on authenticated ports. Additionally, implementing deep packet inspection can help detect exploitation attempts targeting the specific command execution endpoints associated with this vulnerability. Continuous monitoring for anomalous outbound connections from DVRs is also recommended to identify potential compromise early before they are recruited into botnets like Mirai or rapperbot variants.