CVE-2025-34130highexploração observadaCWE-200CWE-306

CVE-2025-34130: falha de alta gravidade em Merit LILIN DVR Firmware

LILIN DVR Arbitrary File Read via net_html.cgi

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar DVR

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

43Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Actcvss 8.7epss 1.1%
da publicação à arma
Publicada no NVD16 de jul.
VulnCheck20 de mar.
An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Merit LILIN · DVR Firmware
CVEs relacionadas — Merit LILIN DVR Firmware

No mesmo produto, das mais perigosas para as menos.

CVE-2025-34132CRITICALLILIN DVR Command Injection via NTPUpdate in dvr_boxEPSS 1.7%CVE-2025-34129HIGHLILIN DVR RCE via Malicious FTP/NTP ConfigurationEPSS 1.1%