PT-2025-29893

CVE-2025-34132

Published

2025-07-16

Updated

2025-10-27

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions LILIN Digital Video Recorder (DVR) versions prior to 2.0b60 20200207

Description A command injection issue exists in LILIN Digital Video Recorder (DVR) devices. The web service at /z/zbin/dvr box does not properly sanitize input provided to the Server field within the NTPUpdate configuration. This allows remote attackers to inject and execute arbitrary commands as root by supplying crafted XML data to the DVRPOST interface.

Recommendations Update LILIN Digital Video Recorder (DVR) to version 2.0b60 20200207 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-20: Improper Input Validation

Related identifiers

CVE-2025-34132