CVE-2025-34132CWE-20CWE-78

LILIN DVR Command Injection via NTPUpdate in dvr_box

Critical · published July 16, 2025

CVSS v4.0
9.3
EPSS
2%
Percentile
77.0
In the wild
Unconfirmed
What it is

A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvr_box fails to properly sanitize input, allowing remote attackers to inject and execute arbitrary commands as root by supplying specially crafted XML data to the DVRPOST interface.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01696 · 77.0th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-07-16T21:26Z
EPSS history
Timeline
  • 16 JUL 21:26Z
    LILIN DVR Command Injection via NTPUpdate in dvr_box
    cvelistv5