Critical severityNVD Advisory· Published Jul 16, 2025· Updated Apr 15, 2026

CVE-2025-34132

Description

A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvr_box fails to properly sanitize input, allowing remote attackers to inject and execute arbitrary commands as root by supplying specially crafted XML data to the DVRPOST interface.

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day/nvd
ducklingstudio.blog.fc2.com/blog-entry-400.htmlnvd
www.meritlilin.com/assets/uploads/support/file/M00158-TW.pdfnvd
www.vulncheck.com/advisories/lilin-dvr-multiple-vulnerabilitiesnvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000