Log in Start free

Vulnerability · Published Jan 12, 2026 · Assigned by twcert

CVE-2026-0854Merit LILIN｜NVR - OS Command Injection

High 8.8

In plain English

A high-severity OS command injection in DH032 from Merit LILIN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.1%top 33.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

Affected products (as reported)

VendorProductVersions
Merit LILIN DH032 0 – through 1.0.28.3858
Merit LILIN DVR708 0 – through 1.3.4
Merit LILIN DVR716 0 – through 1.3.4
Merit LILIN DVR804 0 – through 1.3.4
Merit LILIN DVR808 0 – through 1.3.4
Merit LILIN DVR816 0 – through 1.3.4
Merit LILIN NVR100L 0 – through 1.1.66
Merit LILIN NVR200L 0 – through 1.1.66
Merit LILIN NVR400L 0 – through 1.1.66
Merit LILIN NVR1400L 0 – through 1.1.66
Merit LILIN NVR2400L 0 – through 1.1.66
Merit LILIN NVR3216 0 – through 2.0.74.3921
Merit LILIN NVR3416 0 – through 2.0.74.3921
Merit LILIN NVR3416r 0 – through 2.0.74.3921
Merit LILIN NVR3816 0 – through 2.0.74.3921
Merit LILIN NVR5832 0 – through 4.0.24.4043
Merit LILIN NVR5832S 0 – through 4.0.24.4043
Merit LILIN NVR5104E 0 – through 4.0.24.4078
Merit LILIN NVR5208E 0 – through 4.0.24.4078
Merit LILIN NVR5416E 0 – through 4.0.24.4078

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References