Vulnerability · Published Jul 16, 2025 · Assigned by VulnCheck

CVE-2025-34132LILIN DVR Command Injection via NTPUpdate in dvr_box

Critical 9.3

In plain English

A critical-severity OS command injection in DVR Firmware from Merit LILIN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)1.7%top 22.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvr_box fails to properly sanitize input, allowing remote attackers to inject and execute arbitrary commands as root by supplying specially crafted XML data to the DVRPOST interface.

Affected products (as reported)

Vendor	Product	Versions
Merit LILIN	DVR Firmware	0 – before 2.0b60_20200207

Weakness: CWE-78, CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day/ third-party-advisory, technical-description
https://www.meritlilin.com/assets/uploads/support/file/M00158-TW.pdf vendor-advisory, patch
https://www.vulncheck.com/advisories/lilin-dvr-multiple-vulnerabilities third-party-advisory
https://ducklingstudio.blog.fc2.com/blog-entry-400.html