Read the docs
TI-2025-24288 Aliases CVE-2025-34129GHSA-hjgc-c8mr-mg36

LILIN DVR RCE via Malicious FTP/NTP Configuration

Priority MEDIUM 48CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 due to insufficient sanitization of the FTP and NTP Server fields in the service configuration. An attacker with access to the configuration interface can upload a malicious XML file with injected shell commands in these fields. Upon subsequent configuration syncs, these commands are executed with elevated privileges. This vulnerability was exploited in the wild by the Moobot botnets.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01097 65th percentileScored 2026-11-07
Fix Fixed DVR Firmware (Merit LILIN): 2.0b60_20200207

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Merit LILINDVR Firmwarebefore 2.0b60_202002072.0b60_20200207Patch availableCNA
  • DVR Firmware VendorMerit LILIN Affected before 2.0b60_20200207 Fixed in 2.0b60_20200207 Patch available CNA

Remediation

  • Fix · CNA DVR Firmware (Merit LILIN) Fixed in 2.0b60_20200207

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Merit LILIN DVR Firmware — meritlilin.com/assets/uploads/support/file/M00158-TW.pdf

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2025-24290 LILIN DVR Command Injection via NTPUpdate in dvr_boxPriority MEDIUM 51
    • TI-2025-24289 LILIN DVR Arbitrary File Read via net_html.cgiPriority MEDIUM 46
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34129
  2. 2026-10-03 Alias added: GHSA-hjgc-c8mr-mg36

References

Patch 1

Advisory 1

  • TI-2025-24290 LILIN DVR Command Injection via NTPUpdate in dvr_box CVSS 4.0CRITICAL 9.3
  • TI-2022-23656 Merit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded Credentials CVSS 3.1CRITICAL 9.8
  • TI-2021-10707 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication CVSS 3.1CRITICAL 9.8
  • TI-2025-24289 LILIN DVR Arbitrary File Read via net_html.cgi CVSS 4.0HIGH 8.7
  • TI-2021-10708 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1 CVSS 3.1CRITICAL 9.8
  • TI-2026-00636 Merit LILIN｜IP Camera - OS Command Injection CVSS 4.0HIGH 8.7
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences