CVE-2025-34130

An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.

CVSS

No CVSS.

References

Link	Resource
https://blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day/
https://www.meritlilin.com/assets/uploads/support/file/M00158-TW.pdf
https://www.vulncheck.com/advisories/lilin-dvr-multiple-vulnerabilities

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Existe una lectura arbitraria de archivos no autenticada en los dispositivos LILIN Digital Video Recorder (DVR) anteriores a la versión de firmware 2.0b60_20200207 a través del endpoint /z/zbin/net_html.cgi. Esta vulnerabilidad permite a los atacantes leer archivos de configuración confidenciales, como /zconf/service.xml, que posteriormente pueden utilizarse para facilitar otros ataques, incluyendo la inyección de comandos. Esta vulnerabilidad ha sido explotada in situ junto con otros problemas por botnets como FBot y Moobot.

16 Jul 2025, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-16 22:15

Updated : 2026-06-17 09:13

NVD link : CVE-2025-34130

Mitre link : CVE-2025-34130

CVE.ORG link : CVE-2025-34130

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-34130", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34130", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-17T13:40:34.376179Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Merit LILIN", "product": "DVR Firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0b60_20200207", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-07-16T22:15:24.693", "references": [{"url": "https://blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.meritlilin.com/assets/uploads/support/file/M00158-TW.pdf", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/lilin-dvr-multiple-vulnerabilities", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot."}, {"lang": "es", "value": "Existe una lectura arbitraria de archivos no autenticada en los dispositivos LILIN Digital Video Recorder (DVR) anteriores a la versi\u00f3n de firmware 2.0b60_20200207 a trav\u00e9s del endpoint /z/zbin/net_html.cgi. Esta vulnerabilidad permite a los atacantes leer archivos de configuraci\u00f3n confidenciales, como /zconf/service.xml, que posteriormente pueden utilizarse para facilitar otros ataques, incluyendo la inyecci\u00f3n de comandos. Esta vulnerabilidad ha sido explotada in situ junto con otros problemas por botnets como FBot y Moobot."}], "lastModified": "2026-06-17T09:13:31.233", "sourceIdentifier": "disclosure@vulncheck.com"}