RCE in Merit Lilin Dvr Firmware
CVE-2025-34132
A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvr_box fails to properly sanitize input, allowing remote attackers to inject and execute arbitrary commands as root by supplying specially crafted XML data to the DVRPOST interface.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.017 (75.5th percentile) — read the EPSS interpretation.
Affected products
- Merit Lilin Dvr Firmware — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (technical-description, third-party-advisory)
- disclosure@vulncheck.com (vendor-advisory, patch)
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com