CVE-2026-87827: KGUARD DVR unauthenticated remote command execution vulnerability
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR.
The vulnerability is known to have been exploited in the wild by the Miraiptea (Rimasuta) and Miraiaurora botnets for malware propagation and subsequent DDoS activity. The vulnerability was reported to affect firmware dating from 2016, while firmware released after 2017 appears to mitigate the issue by restricting the affected service to the localhost interface (127.0.0.1) instead of exposing it on all interfaces (0.0.0.0).
The affected-device list reported by Netlab includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants and several associated hardware revisions
The exploit is included in some version of rapperbot and exploited in 2026. This assignment has been made to document the active exploitation and lack of documentation from the vendor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update/adjust KGUARD DVR configuration so the unauthenticated system command execution service is restricted to the localhost interface (127.0.0.1) and is not exposed on all network interfaces (0.0.0.0).
KGUARD DVR command execution service (system command execution service) bind/interface exposure (restrict to localhost) = 127.0.0.1 (localhost only) instead of 0.0.0.0 (all interfaces)
Event History
Frequently Asked Questions
Which devices should be prioritized for investigation?
The reported affected-device list includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants, including several hardware revisions. Devices running firmware dating from 2016 are reported to be affected.
What access does an attacker need to exploit this issue?
An attacker needs network access to the affected command-execution service. No authentication is required when the service is exposed on network interfaces.
Are newer firmware releases expected to reduce exposure?
Firmware released after 2017 appears to mitigate the issue by binding the affected service to localhost (127.0.0.1) rather than all interfaces (0.0.0.0). The provided information describes this as an apparent mitigation, not a confirmed fix for every device and hardware revision.
How can I identify a potentially exposed device?
Check whether the affected command-execution service is listening on all interfaces, represented as 0.0.0.0, rather than only on 127.0.0.1. A device with the service reachable over the network is exposed to unauthenticated command execution.
Is there evidence of active exploitation?
Yes. Mirai_ptea (Rimasuta) and Mirai_aurora botnets are reported to have exploited the issue for malware propagation and DDoS activity, and the exploit is included in some version of rapperbot and was exploited in 2026.