Remote Command Execution Flaw in KGUARD DVR Devices
CVE-2026-87827
Key Information:
- Vendor
Kguard
- Status
- Vendor
- CVE Published:
- 9 September 2026
Badges
What is CVE-2026-87827?
Certain KGUARD DVR devices with outdated firmware exhibit a serious vulnerability, exposing a system command execution service on all network interfaces without authentication. This flaw enables remote attackers to execute arbitrary commands, potentially compromising the device entirely. Exploits utilizing this vulnerability have been observed in the wild, notably by the Mirai_ptea and Mirai_aurora botnets, which leverage firmware versions dating back to 2016. Recent firmware updates released after 2017 have mitigated this risk by restricting access to the affected service, limiting it to the localhost interface (127.0.0.1) instead of the all-inclusive network interface (0.0.0.0). The vulnerability poses significant risks as it enables attackers to gain unauthorized control over the DVR, exposing the device to additional threats, including DDoS attacks.
Affected Version(s)
KGUARD_firmware 0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.