CVE-2025-34130
Published: 16 July 2025
Summary
CVE-2025-34130 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in 360 (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 17.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
An unauthenticated arbitrary file read vulnerability affects LILIN Digital Video Recorder devices running firmware versions prior to 2.0b60_20200207. The flaw resides in the /z/zbin/net_html.cgi endpoint and is associated with CWE-200 and CWE-306, enabling remote attackers to retrieve arbitrary files without authentication or user interaction. The CVSS 4.0 score of 8.7 reflects the network-accessible, high-impact confidentiality exposure.
Attackers can directly request sensitive configuration files such as /zconf/service.xml through the vulnerable endpoint. Successful reads have been chained with other issues to enable command injection and device compromise, with the vulnerability actively leveraged in the wild by the FBot and Moobot botnets.
Vendor and third-party advisories recommend upgrading affected LILIN DVR units to firmware 2.0b60_20200207 or later. The referenced Netlab 360 analysis and VulnCheck advisory document the exploitation activity and provide additional technical context for detection and remediation.
The vulnerability has seen confirmed real-world use by multiple botnets since disclosure, although the EPSS score has remained flat at 0.0167.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21741
Vulnerability details
An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to…
more
facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Session auditing enables detection of unauthorized exposure or access to sensitive information during user activities.
Privacy and security architectures require controls to protect sensitive information from unauthorized exposure across the system lifecycle.
Inventory identifies all systems holding or processing data, enabling detection of unauthorized exposure paths before exploitation.
Protection planning for critical infrastructure directly calls for authentication of access to essential functions before any operation is permitted.
Risk assessments evaluate exposure of critical functions lacking authentication and prioritize corrective controls.
Requires authentication gates on critical functions that must remain unavailable to anonymous public users.
Treats remote activation of surveillance-capable devices as a critical function that must be disabled or authenticated.
Decoys supply misleading data and log access attempts, directly detecting and deflecting unauthorized information exposure.