What’s Vulnerable › Vulnerabilities

CVE-2025-34130: LILIN DVR Arbitrary File Read via net_html.cgi

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-16 · updated 2026-06-17
• Weakness: CWE-200

Description

An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.

Affected products

• Merit LILIN DVR Firmware: before 2.0b60_20200207 — fixed in 2.0b60_20200207

How to fix

Upgrade to a fixed version: Merit LILIN DVR Firmware 2.0b60_20200207. Check the vendor advisory for mitigations.

References

• https://blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day/
• https://www.meritlilin.com/assets/uploads/support/file/M00158-TW.pdf
• https://www.vulncheck.com/advisories/lilin-dvr-multiple-vulnerabilities

Get alerted when CVE-2025-34130 or the next vulnerability affects your stack