CVE-2025-34130— LILIN DVR Arbitrary File Read via net_html.cgi
Quick assessment
Affected
Merit LILIN DVR Firmware
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LILIN Digital Video Recorder是中国台湾利凌（LILIN）公司的一款录像机。 LILIN Digital Video Recorder 2.0b60_20200207之前版本存在安全漏洞，该漏洞源于任意文件读取，可能导致读取敏感配置文件。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Merit LILIN | DVR Firmware | < 2.0b60_20200207 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-34130
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LILIN DVR Arbitrary File Read via net_html.cgi
Source: CVE Program / CVE List V5
Vulnerability Description
An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
LILIN Digital Video Recorder 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
LILIN Digital Video Recorder是中国台湾利凌（LILIN）公司的一款录像机。 LILIN Digital Video Recorder 2.0b60_20200207之前版本存在安全漏洞，该漏洞源于任意文件读取，可能导致读取敏感配置文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Merit LILIN | DVR Firmware | 0 ~ 2.0b60_20200207 | - |
|
II. Public POCs for CVE-2025-34130
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-34130
请登录查看更多情报信息。
Same Patch Batch · Merit LILIN · 2025-07-16 · 3 CVEs total
| CVE-2025-34132 | LILIN DVR Command Injection via NTPUpdate in dvr_box | |
| CVE-2025-34129 | LILIN DVR RCE via Malicious FTP/NTP Configuration |
IV. Related Vulnerabilities
Same weakness: CWE-306
-
CVE-2026-78434
Faveo Helpdesk post-ticket-reply Endpoint FormController.php -
CVE-2026-77915
rConfig 8.0.0 < 8.2.10 Unauthorized Admin Registration via w -
CVE-2026-78369
Missing Authentication Allows Unauthorized Creation of Crypt -
CVE-2026-6017
Missing Authentication for Critical Function in KAON PG5298 -
CVE-2026-78306
DJI Drone Bluetooth Interface Unauthenticated DUML Command E
V. Comments for CVE-2025-34130
No comments yet