Read the docs
TI-2025-24290 Aliases CVE-2025-34132GHSA-g9j5-xpjv-f35r

LILIN DVR Command Injection via NTPUpdate in dvr_box

Priority MEDIUM 51CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvr_box fails to properly sanitize input, allowing remote attackers to inject and execute arbitrary commands as root by supplying specially crafted XML data to the DVRPOST interface.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01696 77th percentileScored 2026-11-07
Fix Fixed DVR Firmware (Merit LILIN): 2.0b60_20200207

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Merit LILINDVR Firmwarebefore 2.0b60_202002072.0b60_20200207Patch availableCNA
  • DVR Firmware VendorMerit LILIN Affected before 2.0b60_20200207 Fixed in 2.0b60_20200207 Patch available CNA

Remediation

  • Fix · CNA DVR Firmware (Merit LILIN) Fixed in 2.0b60_20200207

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Merit LILIN DVR Firmware — meritlilin.com/assets/uploads/support/file/M00158-TW.pdf

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2025-24288 LILIN DVR RCE via Malicious FTP/NTP ConfigurationPriority MEDIUM 48
    • TI-2025-24289 LILIN DVR Arbitrary File Read via net_html.cgiPriority MEDIUM 46
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34132
  2. 2026-10-03 Alias added: GHSA-g9j5-xpjv-f35r

References

Patch 1

Advisory 1

Other 1

  • TI-2022-23656 Merit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded Credentials CVSS 3.1CRITICAL 9.8
  • TI-2025-24288 LILIN DVR RCE via Malicious FTP/NTP Configuration CVSS 4.0HIGH 8.7
  • TI-2021-10707 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication CVSS 3.1CRITICAL 9.8
  • TI-2025-24289 LILIN DVR Arbitrary File Read via net_html.cgi CVSS 4.0HIGH 8.7
  • TI-2021-10708 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1 CVSS 3.1CRITICAL 9.8
  • TI-2026-00636 Merit LILIN｜IP Camera - OS Command Injection CVSS 4.0HIGH 8.7
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences