Read the docs
TI-2025-24289 Aliases CVE-2025-34130GHSA-r252-84qw-9rcg

LILIN DVR Arbitrary File Read via net_html.cgi

Priority MEDIUM 46CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-306.

Summary

An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01116 66th percentileScored 2026-11-07
Fix Fixed DVR Firmware (Merit LILIN): 2.0b60_20200207

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Merit LILINDVR Firmwarebefore 2.0b60_202002072.0b60_20200207Patch availableCNA
  • DVR Firmware VendorMerit LILIN Affected before 2.0b60_20200207 Fixed in 2.0b60_20200207 Patch available CNA

Remediation

  • Fix · CNA DVR Firmware (Merit LILIN) Fixed in 2.0b60_20200207

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Merit LILIN DVR Firmware — meritlilin.com/assets/uploads/support/file/M00158-TW.pdf

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2025-24290 LILIN DVR Command Injection via NTPUpdate in dvr_boxPriority MEDIUM 51
    • TI-2025-24288 LILIN DVR RCE via Malicious FTP/NTP ConfigurationPriority MEDIUM 48
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34130
  2. 2026-10-03 Alias added: GHSA-r252-84qw-9rcg

References

Patch 1

Advisory 1

  • TI-2025-24290 LILIN DVR Command Injection via NTPUpdate in dvr_box CVSS 4.0CRITICAL 9.3
  • TI-2022-23656 Merit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded Credentials CVSS 3.1CRITICAL 9.8
  • TI-2025-24288 LILIN DVR RCE via Malicious FTP/NTP Configuration CVSS 4.0HIGH 8.7
  • TI-2021-10707 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication CVSS 3.1CRITICAL 9.8
  • TI-2021-10708 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1 CVSS 3.1CRITICAL 9.8
  • TI-2026-00636 Merit LILIN｜IP Camera - OS Command Injection CVSS 4.0HIGH 8.7
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences