Executive brief
KGUARD DVR devices (digital video recorders used for security camera monitoring) running vulnerable firmware expose a network service that allows attackers to execute arbitrary system commands without any authentication. An attacker with network access can completely compromise the device and use it for botnet activity, data theft, or as a foothold into protected facilities. The vulnerability affects older firmware from 2016 and earlier; firmware released after 2017 restricts the vulnerable service to local access only.
Technical details
The vulnerability is a network service listening on all interfaces (0.0.0.0) that accepts system commands without authentication. The affected firmware versions date from 2016 and earlier; firmware released after 2017 mitigates this by restricting the service to localhost (127.0.0.1) only. Attack vector is network-based with no authentication required—any remote attacker with network access can execute arbitrary commands with the privileges of the service. Multiple Mirai botnet variants (Mirai_ptea and Mirai_aurora) have been observed exploiting this vulnerability in the wild since at least June 2021 for malware propagation and DDoS attacks. Patches are available in firmware versions released after 2017; older devices should be updated or isolated from untrusted networks.
Affected products
- KGUARD DVR Firmware from 2016 and earlier (multiple D10xx, D11xx, D21xx, D97xx, D98xx, D99xx variants affected)
Timeline
- 2021-03-22: other: First probes against this vulnerability detected in historical data
- 2021-06-22: exploited: Mirai_ptea variant observed exploiting vulnerability in the wild
- 2021-06-25: exploited: Mirai_aurora botnet variant begins using this vulnerability to propagate
- 2026-09-09: advisory: CVE-2026-87827 published documenting active exploitation