This vulnerability (CVE-2025-34132) affects Merit LILIN DVR firmware prior to version 2.0b60_20200207. It is caused by improper neutralization of special elements in the Server field of the NTPUpdate configuration, leading to OS command injection (CWE-78). The vulnerable web service at /z/zbin/dvr_box fails to sanitize input correctly, allowing remote attackers to send crafted XML data to the DVRPOST interface and execute arbitrary commands as root. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and has high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands with root privileges on affected DVR devices, potentially leading to full system compromise. This can result in unauthorized control over the device, data theft, disruption of DVR functionality, or use of the device as a foothold for further network attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Merit LILIN's official channels for firmware updates addressing this vulnerability. Until a fix is available, restricting network access to the affected DVR devices and disabling remote management interfaces where possible may reduce exposure.