Unauthenticated Arbitrary File Read Vulnerability in LILIN Digital Video Recorder Devices

CVE-2025-34130

What is CVE-2025-34130?

An unauthenticated arbitrary file read vulnerability exists in LILIN Digital Video Recorder devices, allowing attackers to access sensitive configuration files through the /z/zbin/net_html.cgi endpoint. Exploitation of this vulnerability enables the reading of files like /zconf/service.xml, which can facilitate additional attacks, including potential command injection. The vulnerability has been actively exploited by multiple botnets such as FBot and Moobot, underscoring the critical need for users to update their firmware to secure versions to mitigate these risks. For more information and mitigation steps, refer to the vendor's advisory and third-party sources.

References