Use of hard-coded credentials in Merit LILIN Ent. Co., Ltd. products - #VU26285

Vulnerability identifier: #VU26285

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-798

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Hard-coded accounts:

root/icatch99
report/8Jg0SR8K50

Note, this vulnerability is being actively exploited in the wild since August 2019.

DHD204
DHD316A
DHD508A
DHD304A
DHD308A
DHD516A
DHD504A
DHD216
DHD204A
DHD208A
DHD216A
DHD208

Install updates from vendor's website.

DHD316A - update to 2.0b1_20200122
DHD508A - update to 2.0b1_20200122
DHD304A - update to 2.0b1_20200122
DHD308A - update to 2.0b1_20200122
DHD516A - update to 2.0b1_20200122
DHD504A - update to 2.0b1_20200122
DHD216 - update to 2.0b60_20200207
DHD204A - update to 2.0b60_20200207
DHD208A - update to 2.0b60_20200207
DHD216A - update to 2.0b60_20200207
DHD208 - update to 2.0b60_20200207

• https://blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day-en/
• http://www.meritlilin.com/tw/support/file/type/Firmware
• https://www.meritlilin.com/assets/uploads/support/file/M00158-TW.pdf

• Multiple vulnerabilities in Merit LILIN DVR devices