EUVD-2026-74805
GHSA-mxww-3qmj-g8p3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, single-step command execution as root gives full C/I/A on the device; scope Unchanged since impact is confined to the compromised DVR's own security authority.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
4DescriptionCVE.org
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR.
The vulnerability is known to have been exploited in the wild by the Mirai_ptea (Rimasuta) and Mirai_aurora botnets for malware propagation and subsequent DDoS activity. The vulnerability was reported to affect firmware dating from 2016, while firmware released after 2017 appears to mitigate the issue by restricting the affected service to the localhost interface (127.0.0.1) instead of exposing it on all interfaces (0.0.0.0).
The affected-device list reported by Netlab includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants and several associated hardware revisions
The exploit is included in some version of rapperbot and exploited in 2026. This assignment has been made to document the active exploitation and lack of documentation from the vendor.
AnalysisAI
Remote code execution in KGUARD DVR devices running 2016-era firmware allows any unauthenticated attacker with network reachability to run arbitrary system commands, because a command-execution service is bound to all interfaces (0.0.0.0) with no authentication, leading to full device takeover. The flaw is actively exploited in the wild by the Mirai_ptea (Rimasuta), Mirai_aurora, and rapperbot botnets for malware propagation and DDoS, per Netlab 360 reporting. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the affected command-execution service, which on vulnerable 2016-era firmware is bound to 0.0.0.0 (all interfaces) and requires no authentication - so any device with the service reachable (e.g., internet-exposed via port-forwarding, or an attacker on the same LAN) is exploitable in a single step with no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a top-priority, immediately actionable risk, not a paper-tiger high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade affected devices to KGUARD firmware released after 2017, which binds the command-execution service to 127.0.0.1 instead of 0.0.0.0; no vendor advisory or specific patched version number was published (the CVE was assigned in part to document the vendor's lack of documentation), so verify the fix by confirming the service no longer listens on external interfaces. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately identify all KGUARD DVR devices in your environment, prioritizing devices running 2016-era firmware, and assess their network exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today