Path traversal in Merit LILIN Ent. Co., Ltd. products - #VU26287

Vulnerability identifier: #VU26287

CSH Severity: High

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote authenticated user to read arbitrary files on the system.

The vulnerability exists due to absent filtration of user-supplied data passed to /z/zbin/net_html.cgi URL. A remote authenticated user can view contents of arbitrary files on the system.

Note, this vulnerability can be exploited by non-authenticated attacker using hard-coded credentials issue (described in vulnerability #1).

DHD204
DHD316A
DHD508A
DHD304A
DHD308A
DHD516A
DHD504A
DHD216
DHD204A
DHD208A
DHD216A
DHD208

Install updates from vendor's website.

DHD316A - update to 2.0b1_20200122
DHD508A - update to 2.0b1_20200122
DHD304A - update to 2.0b1_20200122
DHD308A - update to 2.0b1_20200122
DHD516A - update to 2.0b1_20200122
DHD504A - update to 2.0b1_20200122
DHD216 - update to 2.0b60_20200207
DHD204A - update to 2.0b60_20200207
DHD208A - update to 2.0b60_20200207
DHD216A - update to 2.0b60_20200207
DHD208 - update to 2.0b60_20200207

• https://blog.netlab.360.com/multiple-botnets-are-spreading-using-lilin-dvr-0-day-en/
• http://www.meritlilin.com/tw/support/file/type/Firmware
• https://www.meritlilin.com/assets/uploads/support/file/M00158-TW.pdf

• Multiple vulnerabilities in Merit LILIN DVR devices