CVE-2026-87827
CriticalCVSS 10.0Summary
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker can execute arbitrary system commands, potentially leading to complete compromise. Exploited by Mirai_ptea and Mirai_aurora botnets for malware propagation and DDoS.
Risk Assessment
DVR devices can be hijacked and enrolled into botnets, threatening network integrity and enabling DDoS attacks on other systems.
Recommendation
Update DVR firmware to versions released after 2017, which restrict the service to localhost (127.0.0.1).
Related vulnerabilities
- CVE-2026-115932Critical
In Postiz, a media path that is not a web address is treated as a file on the server's disk without verifying it lies inside the upload directory. A registered user can store a crafted media path with a post and cause the publishing worker to read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads are reachable through two further routes, including file existence checks and backend memory exhaustion; self-registration is open by default.
- CVE-2026-94075Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 contains a deserialization of untrusted data vulnerability, allowing object injection. This could enable an attacker to execute unintended code.
- CVE-2026-114196Critical
The WordPress plugin Paytium up to version 5.0.5 is vulnerable to deserialization of untrusted data, allowing object injection. This may enable an attacker to perform unauthorized actions.
- CVE-2026-112866Critical
The WordPress plugin Product Filter by WBW (woo-product-filter) up to version 3.4.6 is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker could exploit this to manipulate database queries.
- CVE-2026-111402Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. This could allow an attacker to execute arbitrary SQL queries.
- CVE-2026-115806Critical
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine. An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint. When an administrator performs a routine export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library, so no additional plugin or theme is required.
- CVE-2026-115931Critical
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels, but the backend did not restrict which functions could be requested, allowing calls to internal helpers. One helper reads a file from the server's disk (e.g., environment file with the session signing secret, database address, and service credentials), and another makes the backend process exit with a single request. Self-registration is open by default, so no existing account or action by another user is needed.
- CVE-2026-115893Critical
Wasmtime prior to 36.0.19, 48.0.7, and 49.0.4 has a flaw in the Cranelift compiler on aarch64. A br_table instruction with more than ~256,000 targets can be miscompiled, allowing a jump to arbitrary code and sandbox escape.
- CVE-2026-115889Critical
Wasmtime prior to 36.0.19 and 43.0.0 has a flaw in the Cranelift compiler where SSA value indices can silently overflow when compiling large Wasm functions. This can cause miscompilation, type confusion, and sandbox escape.
- CVE-2026-115812Critical
A relative path traversal during model archive extraction in AWS Multi Model Server 1.1.11 and earlier allows remote actors to execute arbitrary code via a crafted model archive. The project is end of life and no fixed version is available.
Original NVD description (English source)
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR. The vulnerability is known to have been exploited in the wild by the Mirai_ptea (Rimasuta) and Mirai_aurora botnets for malware propagation and subsequent DDoS activity. The vulnerability was reported to affect firmware dating from 2016, while firmware released after 2017 appears to mitigate the issue by restricting the affected service to the localhost interface (127.0.0.1) instead of exposing it on all interfaces (0.0.0.0). The affected-device list reported by Netlab includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants and several associated hardware revisions The exploit is included in some version of rapperbot and exploited in 2026. This assignment has been made to document the active exploitation and lack of documentation from the vendor.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS