CVE-2025-34132

CRITICAL

LILIN DVR Command Injection via NTPUpdate in dvr_box

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-34132 has a selected CVSS score of 9.3 (critical).

Description

A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvr_box fails to properly sanitize input, allowing remote attackers to inject and execute arbitrary commands as root by supplying specially crafted XML data to the DVRPOST interface.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 20, 2020 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 17, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Digital Video Recorder (DVR)

Browse LILIN / Digital Video Recorder (DVR)
VulnCheckVersion data not supplied

DVR Firmware

Browse Merit LILIN / DVR Firmware

Default status: unaffected

CVE ListBefore 2.0b60_20200207affected

References

5