A Mirai-variant botnet called Nexcorium is actively exploiting unpatched and end-of-life TBK DVR and TP-Link router devices to build a DDoS-capable botnet. Organizations with these devices on or near their network perimeters, particularly in surveillance, SMB networking, or remote-access infrastructure, face risk of device compromise, downstream DDoS amplification, and potential lateral movement into adjacent network segments. Direct enterprise risk is moderate but elevated by the 99th-percentile EPSS score on the primary CVE, indicating active, widespread exploitation in the wild.