Command Injection Vulnerability in LILIN Digital Video Recorder Devices

CVE-2025-34129

What is CVE-2025-34129?

A command injection flaw has been detected in LILIN Digital Video Recorder (DVR) devices due to inadequate input validation in the FTP and NTP Server configuration fields. This vulnerability allows an attacker with access to the device's configuration interface to upload a malicious XML file containing malicious shell commands. These commands are subsequently executed with elevated permissions during configuration synchronizations, leading to a compromise of system integrity. The Moobot botnets have been identified as a group actively exploiting this vulnerability in the wild.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References