PT-2025-29893 · Lilin · Lilin Digital Video Recorder

360 Netlab · Published 2025-07-16 · Updated 2025-10-27 · CVE-2025-34132

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LILIN Digital Video Recorder (DVR) versions prior to 2.0b60 20200207

Description A command injection issue exists in LILIN Digital Video Recorder (DVR) devices. The web service at /z/zbin/dvr box does not properly sanitize input provided to the Server field within the NTPUpdate configuration. This allows remote attackers to inject and execute arbitrary commands as root by supplying crafted XML data to the DVRPOST interface.

Recommendations Update LILIN Digital Video Recorder (DVR) to version 2.0b60 20200207 or later.

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2025-34132

Affected Products

Lilin Digital Video Recorder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-34132 · Security Note
• https://meritlilin.com/assets/uploads/support/file/M00158-TW.pdf · Patch, Vendor Advisory
• https://ducklingstudio.blog.fc2.com/blog-entry-400.html · Note
• https://twitter.com/CVEnew/status/1945604325553955124 · Twitter Post
• https://vulncheck.com/advisories/lilin-dvr-multiple-vulnerabilities · Note
• https://t.me/cvetracker/28015 · Telegram Post
• https://blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day · Note
• https://t.me/cveNotify/140561 · Telegram Post