CVE-2026-0854

HIGH

Merit LILIN DVR/NVR - Authenticated OS Command Injection

Title source: llm
STIX 2.1

Description

Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

References (2)

Core 2
Core References
Various Sources third-party-advisory
https://www.twcert.org.tw/tw/cp-132-10624-6599c-1.html
Various Sources third-party-advisory
https://www.twcert.org.tw/en/cp-139-10623-4f523-2.html

Scores

CVSS v3 8.8
EPSS 0.0103
EPSS Percentile 59.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (20)
Merit LILIN/DH032 < 1.0.28.3858
Merit LILIN/DVR708 < 1.3.4
Merit LILIN/DVR716 < 1.3.4
Merit LILIN/DVR804 < 1.3.4
Merit LILIN/DVR808 < 1.3.4
Merit LILIN/DVR816 < 1.3.4
Merit LILIN/NVR100L < 1.1.66
Merit LILIN/NVR1400L < 1.1.66
Merit LILIN/NVR200L < 1.1.66
Merit LILIN/NVR2400L < 1.1.66
... and 10 more
Published Jan 12, 2026
Tracked Since Feb 18, 2026