CVE-2025-34132 — LILIN DVR Command Injection via NTPUpdate in dvr_box
A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NTPUpdate configurat…
Published: 2025-07-16 · CVSS: 9.3 · CVSS 4.0
A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvr_box fails to properly sanitize input, allowing remote attackers to inject and execute arbitrary commands as root by supplying specially crafted XML data to the DVRPOST interface.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7