Vulnerabilities

TI-2026-00636 CVE-2026-0855 · GHSA-vfvj-3wmg-p6fj

Merit LILIN｜IP Camera - OS Command Injection

MEDIUM 42

Certain IP Camera models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01175 Published 2026-01-12 No fix listed CWE-78

TI-2026-00635 CVE-2026-0854 · GHSA-v5x6-vvfr-6v34

Merit LILIN｜NVR - OS Command Injection

MEDIUM 42

Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0115 Published 2026-01-12 No fix listed CWE-78

TI-2025-24290 CVE-2025-34132 · GHSA-g9j5-xpjv-f35r

LILIN DVR Command Injection via NTPUpdate in dvr_box

MEDIUM 51

A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NTPUpdate configuration.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01696 Published 2025-07-16 Fixed in 2.0b60_20200207 CWE-20

TI-2025-24289 CVE-2025-34130 · GHSA-r252-84qw-9rcg

LILIN DVR Arbitrary File Read via net_html.cgi

MEDIUM 46

An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01116 Published 2025-07-16 Fixed in 2.0b60_20200207 CWE-200

TI-2025-24288 CVE-2025-34129 · GHSA-hjgc-c8mr-mg36

LILIN DVR RCE via Malicious FTP/NTP Configuration

MEDIUM 48

A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 due to insufficient sanitization of the FTP and NTP Server fields in the service configurat…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01097 Published 2025-07-16 Fixed in 2.0b60_20200207 CWE-20

TI-2022-23656 CVE-2022-47618 · GHSA-x6cv-8qm7-rqw4

Merit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded Credentials

MEDIUM 51

Merit LILIN AH55B04 & AH55B08 DVR firm has hard-coded administrator credentials.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01089 Published 2023-01-03 No fix listed CWE-798

TI-2021-10709 CVE-2021-30169 · GHSA-xcmh-9w7w-qf4p

MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2

LOW 36

The sensitive information of webcam device is not properly protected.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01679 Published 2021-04-28 No fix listed CWE-200

TI-2021-10708 CVE-2021-30168 · GHSA-2fm2-p76r-3mv9

MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1

MEDIUM 46

The sensitive information of webcam device is not properly protected.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02075 Published 2021-04-28 No fix listed CWE-200

TI-2021-10707 CVE-2021-30167 · GHSA-c85v-wp83-g55c

MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication

MEDIUM 47

The manage users profile services of the network camera device allows an authenticated.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02443 Published 2021-04-28 No fix listed CWE-522

TI-2021-10706 CVE-2021-30166 · GHSA-3g9r-wrp4-36rm

MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection

LOW 38

The NTP Server configuration function of the IP camera device is not verified with special parameters.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.03786 Published 2021-04-28 No fix listed CWE-78

Vulnerabilities

Filters