Merit LILIN DVR devices running firmware versions before 2.0b60_20200207 are vulnerable to OS command injection due to insufficient input sanitization of FTP and NTP Server configuration fields. An attacker able to upload a crafted XML configuration file can inject shell commands that execute with elevated privileges when the device syncs its configuration. This vulnerability is tracked as CVE-2025-34129 with a CVSS 4.0 base score of 8.7, indicating a high impact. Exploitation has been observed in the wild by the Moobot botnets. No patch or remediation details are provided in the available data.

Successful exploitation allows an attacker with configuration interface access to execute arbitrary OS commands with elevated privileges on affected Merit LILIN DVR devices. This can lead to full compromise of the device, enabling control over its functions and potentially the network it resides on. The vulnerability has been actively exploited by Moobot botnets, confirming real-world impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the configuration interface to trusted users only and monitor for suspicious configuration uploads. Avoid exposing the device management interface to untrusted networks.