PT-2025-29892 · Lilin · Lilin Digital Video Recorder

360 Netlab · Published 2025-07-16 · Updated 2025-07-17 · CVE-2025-34130

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LILIN Digital Video Recorder (DVR) versions prior to 2.0b60 20200207

Description An unauthenticated arbitrary file read issue exists in LILIN Digital Video Recorder (DVR) devices. This allows attackers to read sensitive configuration files, such as /zconf/service.xml, potentially leading to further attacks like command injection. The /z/zbin/net html.cgi endpoint is the entry point for this issue. This vulnerability has been exploited in the wild by botnets, including FBot and Moobot.

Recommendations Update LILIN Digital Video Recorder (DVR) to version 2.0b60 20200207 or later.

Fix

Missing Authentication

Information Disclosure

Weakness Enumeration

CWE-306

CWE-200

Related Identifiers

CVE-2025-34130

Affected Products

Lilin Digital Video Recorder

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-34130 · Security Note
• https://twitter.com/VulmonFeeds/status/1945658418213036216 · Twitter Post
• https://meritlilin.com/assets/uploads/support/file/M00158-TW.pdf · Patch, Vendor Advisory
• https://t.me/cvetracker/28014 · Telegram Post
• https://blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day · Note
• https://vulncheck.com/advisories/lilin-dvr-multiple-vulnerabilities · Note
• https://twitter.com/CVEnew/status/1945604326589960544 · Twitter Post