CVE-2026-87827
Certain KGUARD DVR devices expose a system command execution service on all network interfaces without authentication. A remote attacker can run arbitrary commands, potentially taking full control of the device. The flaw has been actively exploited by Mirai botnets for malware spread and DDoS attacks.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
KGUARD DVR models D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, D99xx and related hardware revisions.
Real-world impact
An attacker can execute any system command, giving them complete control over the DVR, enabling malware installation, data exfiltration, and participation in botnet DDoS campaigns.
Why this severity
The CVSS score of 10 reflects that the vulnerability allows unauthenticated remote command execution with full system privileges, no user interaction, and can be exploited over the network, leading to total compromise.
What to do about it
- 01Upgrade the device firmware to a version released after 2017, which restricts the vulnerable service to localhost.
NVD-referenced vendor firmware update
Timeline
- Sep 9, 2026 · 5d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 9, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.