CVE-2025-34132: Merit Lilin Dvr Firmware

Critical severity, CVSS 9.3. EPSS: 1.7% chance of exploitation in the next 30 days.

A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvr_box fails to properly sanitize input, allowing remote attackers to inject and execute arbitrary commands as root by supplying specially crafted XML data to the DVRPOST interface.

Affected products

• Merit Lilin Dvr Firmware: before 2.0b60_20200207 (fixed in 2.0b60_20200207)

Published 2025-07-16. Last modified 2026-06-17.