JPCERT flags vulnerable DVR/NVR scanning traffic

14 May 2026 routine vulnerability

JPCERT's TSUBAME sensors observed Telnet scanning traffic largely originating from outdated, unpatched DVR/NVR devices in Q4 2025.

JPCERT/CC's TSUBAME Report Overflow for October-December 2025 examines monitoring trends from its global sensor network, focusing on Telnet (23/TCP) traffic originating from Japan. Analysts observed a spike in October followed by a decline from early November, but noted that a large share of this traffic—up to 80% on some days—came from specific groups of DVR/NVR devices. Login banners on these devices showed outdated copyright dates (e.g., 2014), indicating long-neglected firmware that likely contains known, exploitable vulnerabilities.

The report also compared packet volumes between domestic and overseas sensors, finding overseas sensors consistently receive more traffic, with a gradual upward trend in both regions from October onward. Common destination ports (22, 23, 80, 443, 8080/TCP) were observed across nearly all sensors regardless of region, indicating widespread, non-targeted scanning activity against these standard service ports.

No specific alerts or novel threats were issued this quarter; the report is primarily informational, reinforcing the value of distributed monitoring and urging owners of DVR/NVR devices to verify firmware update status given the persistence of internet-facing, outdated devices.

Detection guidance

Telnet Connection Attempts to Standard Service Ports

ATT&CK T1595

Detects Telnet (23/TCP) connections to multiple standard service ports (22, 80, 443, 8080) indicative of active scanning for vulnerable services. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Telnet Connection Attempts to Standard Service Ports
description: Detects Telnet protocol connections to common service ports (SSH, HTTP,
  HTTPS, alternate HTTP) which is characteristic of non-targeted active scanning for
  vulnerable network appliances.
tags:
- attack.reconnaissance
- attack.t1595
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
    - 22
    - 80
    - 443
    - 8080
    Protocol: tcp
  telnet_source:
    SourcePort: 23
  condition: selection and telnet_source
falsepositives:
- Legitimate network monitoring tools initiating service discovery
- Authorized penetration testing or vulnerability assessment traffic
level: medium
id: 06b1850f-35c8-5f81-b2c4-84e16dc00a5a
status: experimental
author: Vorant

DVR/NVR Device Outbound Scanning Activity

ATT&CK T1595

Identifies outbound network connections from devices with outdated firmware signatures or known DVR/NVR user-agent patterns initiating connections to multiple destination ports. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: DVR/NVR Device Outbound Scanning Activity
description: Detects outbound scanning-like connection patterns from network appliances
  (DVR/NVR devices) characterized by connections to multiple standard service ports
  from a single source, typical of compromised or misconfigured devices performing
  active reconnaissance.
tags:
- attack.reconnaissance
- attack.t1595
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
    - 22
    - 23
    - 80
    - 443
    - 8080
  outbound:
    Initiated: true
  filter_internal_dest:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and outbound and not filter_internal_dest
falsepositives:
- Legitimate firmware update checks from networked devices
- Network health monitoring by device management platforms
level: low
id: a0c9c854-6f06-5df5-9c2c-25cd975e10dd
status: experimental
author: Vorant

Multiple Telnet Authentication Attempts from Single Source

ATT&CK T1078

Detects multiple Telnet login attempts (23/TCP) from a single source IP across a short timeframe, indicating potential credential guessing against Telnet-accessible devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Multiple Telnet Authentication Attempts from Single Source
description: Identifies repeated Telnet connection attempts on port 23/TCP from a
  single source within a short window, consistent with credential guessing or brute-force
  activity against Telnet-accessible network devices such as DVR/NVR appliances.
tags:
- attack.credential-access
- attack.t1078
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 23
    Protocol: tcp
  condition: selection
falsepositives:
- Network administrators troubleshooting device connectivity via Telnet
- Automated device provisioning or configuration management systems
level: medium
id: 7e8dd255-2420-5e9b-85b6-1c53e2f39761
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://blogs.jpcert.or.jp/en/2026/05/tsubame_overflow_2025-10-12.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free