CVE-2025-34132

🗓️ 16 Jul 2025 21:26:51Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 16 Views🌐 WEB

Command injection vulnerability in LILIN DVR allows remote execution of commands via NTPUpdate configuration.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2025-34132	16 Jul 202521:26	–	attackerkb
Circl	CVE-2025-34132	17 Jul 202521:02	–	circl
CNNVD	LILIN Digital Video Recorder 安全漏洞	16 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-34132 LILIN DVR Command Injection via NTPUpdate in dvr_box	16 Jul 202521:26	–	cvelist
EUVD	EUVD-2025-21740	3 Oct 202520:07	–	euvd
NVD	CVE-2025-34132	16 Jul 202522:15	–	nvd
Positive Technologies	PT-2025-29893 · Lilin · Lilin Digital Video Recorder	16 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34132	18 Jul 202521:58	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2025-34132	20 Mar 202000:00	–	vulncheck_kev
Vulnrichment	CVE-2025-34132 LILIN DVR Command Injection via NTPUpdate in dvr_box	16 Jul 202521:26	–	vulnrichment

Vulners

CNA

Node

merit_lilin dvr_firmwareRange0–2.0b60_20200207

[
  {
    "defaultStatus": "unaffected",
    "product": "DVR Firmware",
    "vendor": "Merit LILIN",
    "versions": [
      {
        "lessThan": "2.0b60_20200207",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
meritlilin	www.meritlilin.com/assets/uploads/support/file/M00158-TW.pdf
ducklingstudio	www.ducklingstudio.blog.fc2.com/blog-entry-400.html
vulncheck	www.vulncheck.com/advisories/lilin-dvr-multiple-vulnerabilities
blog	www.blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day/

Parameter	Position	Path	Description	CWE
Server	request body	/z/zbin/dvr_box	Remote command injection via unsanitized XML data in the DVRPOST interface	CWE-20, CWE-78

15 May 2026 11:14Current

7.8High risk

Vulners AI Score7.8

CVSS 49.3

EPSS0.02349

SSVC