Kguard Firmware
Monthly
Remote code execution in KGUARD DVR devices running 2016-era firmware allows any unauthenticated attacker with network reachability to run arbitrary system commands, because a command-execution service is bound to all interfaces (0.0.0.0) with no authentication, leading to full device takeover. The flaw is actively exploited in the wild by the Mirai_ptea (Rimasuta), Mirai_aurora, and rapperbot botnets for malware propagation and DDoS, per Netlab 360 reporting. Firmware released after 2017 mitigates the issue by restricting the service to the localhost interface.
Remote code execution in KGUARD DVR devices running 2016-era firmware allows any unauthenticated attacker with network reachability to run arbitrary system commands, because a command-execution service is bound to all interfaces (0.0.0.0) with no authentication, leading to full device takeover. The flaw is actively exploited in the wild by the Mirai_ptea (Rimasuta), Mirai_aurora, and rapperbot botnets for malware propagation and DDoS, per Netlab 360 reporting. Firmware released after 2017 mitigates the issue by restricting the service to the localhost interface.