CVE-2025-34130: CWE-306 Missing Authentication for Critical Function in Merit LILIN DVR Firmware
An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.
CVE-2025-34130: CWE-306 Missing Authentication for Critical Function in Merit LILIN DVR Firmware
Description
An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-04-15T19:15:22.562Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 68781a21a83201eaacded28b
Added to database: 7/16/2025, 9:31:13 PM
Last updated: 7/16/2025, 9:31:13 PM
Views: 1
Related Threats
CVE-2025-34128: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in X360Soft X360 VideoPlayer ActiveX Control
HighCVE-2025-34132: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Merit LILIN DVR Firmware
CriticalCVE-2025-34129: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Merit LILIN DVR Firmware
HighCVE-2025-34123: CWE-121 Stack-based Buffer Overflow in VideoCharge Software Studio
HighCVE-2025-34121: CWE-434 Unrestricted Upload of File with Dangerous Type in Idera Up.Time Monitoring Station
CriticalActions
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.