OS Command Injection in Merit LILIN Ent. Co., Ltd. products - #VU26286

Vulnerability identifier: #VU26286

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote authenticated user to execute arbitrary shell commands on the target system.

The vulnerability exists due to absent filtration of user-supplied data to /z/zbin/dvr_box URL when processing XML files. The affected parameters are NTPUpdate, FTP, and NTP.  A remote authenticated user can inject and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, this vulnerability can be exploited by non-authenticated attacker using hard-coded credentials issue (described in vulnerability #1).

DHD204
DHD316A
DHD508A
DHD304A
DHD308A
DHD516A
DHD504A
DHD216
DHD204A
DHD208A
DHD216A
DHD208

Install updates from vendor's website.

DHD316A - update to 2.0b1_20200122
DHD508A - update to 2.0b1_20200122
DHD304A - update to 2.0b1_20200122
DHD308A - update to 2.0b1_20200122
DHD516A - update to 2.0b1_20200122
DHD504A - update to 2.0b1_20200122
DHD216 - update to 2.0b60_20200207
DHD204A - update to 2.0b60_20200207
DHD208A - update to 2.0b60_20200207
DHD216A - update to 2.0b60_20200207
DHD208 - update to 2.0b60_20200207

• https://blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day-en/
• http://www.meritlilin.com/tw/support/file/type/Firmware
• https://www.meritlilin.com/assets/uploads/support/file/M00158-TW.pdf

• Multiple vulnerabilities in Merit LILIN DVR devices