CVE-2025-34129
Published: 16 July 2025
Summary
CVE-2025-34129 is a high-severity Improper Input Validation (CWE-20) vulnerability in 360 (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 21.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A command injection vulnerability affects LILIN Digital Video Recorder devices running firmware versions prior to 2.0b60_20200207. Insufficient sanitization of the FTP and NTP Server fields in the service configuration allows an attacker to supply unsanitized input that is later executed as shell commands. The issue is tracked under CWE-20 and CWE-78 and carries a CVSS 4.0 score of 8.7.
An attacker who can reach the configuration interface may upload a malicious XML file containing injected commands in the affected fields. On the next configuration sync the commands execute with elevated privileges, enabling full control of the device. The vulnerability has been exploited in the wild by the Moobot botnet.
Vendor guidance and third-party advisories direct users to upgrade to firmware 2.0b60_20200207 or later; the referenced LILIN support bulletin and VulnCheck advisory provide the corresponding patch and configuration recommendations. Exploitation probability remains low and unchanged at an EPSS of 0.0107.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21742
Vulnerability details
A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 due to insufficient sanitization of the FTP and NTP Server fields in the service configuration. An attacker with access to the configuration interface…
more
can upload a malicious XML file with injected shell commands in these fields. Upon subsequent configuration syncs, these commands are executed with elevated privileges. This vulnerability was exploited in the wild by the Moobot botnets.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Directly implements checks on information inputs to reject invalid data before processing.
Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.
Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.
Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.
Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.