CVE-2025-34130: LILIN DVR Arbitrary File Read via net_html.cgi
Description
An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.
Known Exploited
🚨 Marked as known exploited on July 16th, 2025 (1 day ago).
Classification
CVE ID: CVE-2025-34130
CVSS Base Severity: HIGH
CVSS Base Score: 8.7
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Problem Types
CWE-306 Missing Authentication for Critical Function CWE-200 Exposure of Sensitive Information to an Unauthorized ActorAffected Products
Vendor: Merit LILIN
Product: DVR Firmware
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.66% (probability of being exploited)
EPSS Percentile: 70.31% (scored less or equal to compared to others)
EPSS Date: 2025-07-17 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-34130https://blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day/
https://www.meritlilin.com/assets/uploads/support/file/M00158-TW.pdf
https://www.vulncheck.com/advisories/lilin-dvr-multiple-vulnerabilities