KGUARD DVR unauthenticated remote command execution vulnerability
KGUARD · KGUARD_firmware
Higher than 65% of scored CVEs
DescriptionNVD
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR. The vulnerability is known to have been exploited in the wild by the Mirai_ptea (Rimasuta) and Mirai_aurora botnets for malware propagation and subsequent DDoS activity. The vulnerability was reported to affect firmware dating from 2016, while firmware released after 2017 appears to mitigate the issue by restricting the affected service to the localhost interface (127.0.0.1) instead of exposing it on all interfaces (0.0.0.0). The affected-device list reported by Netlab includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants and several associated hardware revisions The exploit is included in some version of rapperbot and exploited in This assignment has been made to document the active exploitation and lack of documentation from the vendor.
Coverage2 articles · 2 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 15 Sep.
- Tue 15 Sep, 02:21 UTC. SecurityOnline, first report. Mirai Botnets Exploit Critical KGUARD DVR Flaw to Spread Malware.
- Mon 5 Oct, 21:58 UTC. Dark Reading, its first report on the story. ClingSTUN turns vulnerable IoT devices into proxy nodes using STUN servers.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 15 Sep 02:21 | SecurityOnline | Mirai Botnets Exploit Critical KGUARD DVR Flaw to Spread Malware |
| 5 Oct 21:58 | Dark Reading | ClingSTUN turns vulnerable IoT devices into proxy nodes using STUN servers |
- ClingSTUN turns vulnerable IoT devices into proxy nodes using STUN serversDark Reading · mentions it in passing
- Mirai Botnets Exploit Critical KGUARD DVR Flaw to Spread MalwareSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.