This vulnerability (CVE-2025-34130) affects Merit LILIN Digital Video Recorder firmware versions before 2.0b60_20200207. It is caused by missing authentication controls on a critical function accessible through the /z/zbin/net_html.cgi endpoint, enabling unauthenticated arbitrary file reads. Attackers can retrieve sensitive configuration files, which may be leveraged to conduct additional attacks including command injection. The CVSS 4.0 base score is 8.7, reflecting network attack vector, no required privileges or user interaction, and high confidentiality impact. Exploitation has been observed in the wild in combination with other vulnerabilities by botnets like FBot and Moobot. No patch or official fix information is currently available.

Successful exploitation allows unauthenticated attackers to read sensitive configuration files from affected DVR devices, compromising confidentiality. This exposure can lead to further exploitation such as command injection, increasing the risk of device takeover or network compromise. The vulnerability has been actively exploited by known botnets, indicating a real-world threat. The high CVSS score (8.7) reflects the critical nature of the confidentiality breach and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to affected DVR devices, especially blocking access to the /z/zbin/net_html.cgi endpoint from untrusted networks. Monitor for unusual activity indicative of exploitation attempts. Follow vendor communications closely for updates on patches or official mitigations.