CVE-2026-87827: CWE-1188 Insecure Default Initialization of Resource in KGUARD KGUARD_firmware
Affects KGUARD KGUARD_firmwareSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 1.0% chance of exploitation in 30 days – higher than 64% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| KGUARDKGUARD_firmware | Affected– | Fixed in– |
AI-suggested
Firmware released after 2017 mitigates this vulnerability by restricting the affected service to the localhost interface only. Users should upgrade to firmware versions released after 2017 to remediate this issue. Until patched, network access to the vulnerable service should be restricted or blocked to prevent exploitation.
Description
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR. The vulnerability is known to have been exploited in the wild by the Mirai_ptea (Rimasuta) and Mirai_aurora botnets for malware propagation and subsequent DDoS activity. The vulnerability was reported to affect firmware dating from 2016, while firmware released after 2017 appears to mitigate the issue by restricting the affected service to the localhost interface (127.0.0.1) instead of exposing it on all interfaces (0.0.0.0). The affected-device list reported by Netlab includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants and several associated hardware revisions The exploit is included in some version of rapperbot and exploited in 2026. This assignment has been made to document the active exploitation and lack of documentation from the vendor.
Impact
Remote unauthenticated attackers can execute arbitrary system commands on affected KGUARD DVR devices, potentially resulting in full device compromise. This enables attackers to deploy malware, including botnets like Mirai variants, and conduct distributed denial-of-service (DDoS) attacks. The vulnerability has been exploited in the wild, demonstrating active threat and significant risk to affected devices.
Summary
KGUARD DVR devices running firmware from 2016 expose a system command execution service bound to all network interfaces (0.0.0.0) without authentication, allowing remote unauthenticated attackers to execute arbitrary system commands. This insecure default initialization of a resource (CWE-1188) leads to potential complete device compromise. The vulnerability has been actively exploited by Mirai_ptea and Mirai_aurora botnets for malware propagation and DDoS activities. Firmware versions released after 2017 mitigate the vulnerability by binding the service to the localhost interface (127.0.0.1), preventing remote exploitation. Affected devices include multiple D1000 and D1100 series models and others. The exploit is included in some versions of rapperbot malware, with active exploitation documented in 2026.