CVE-2025-34130CWE-200CWE-306

LILIN DVR Arbitrary File Read via net_html.cgi

High · published July 16, 2025

CVSS v4.0
8.7
EPSS
1%
Percentile
65.8
In the wild
Unconfirmed
What it is

An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.01116 · 65.8th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-306 · Missing Authentication for Critical Function
Published
2025-07-16T21:26Z
EPSS history
Timeline
  • 16 JUL 21:26Z
    LILIN DVR Arbitrary File Read via net_html.cgi
    cvelistv5