Merit LILIN DVR/NVR OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in certain DVR/NVR models developed by Merit LILIN. This vulnerability allows authenticated remote attackers to inject arbitrary operating system commands and execute them on the device. Affected models include the DH032, DVR708, DVR716, DVR804, DVR808, DVR816, NVR100L, NVR200L, NVR400L, NVR1400L, NVR2400L, NVR3216, NVR3416, NVR3416r, NVR3816, NVR5832, NVR5832S, NVR5104E, NVR5208E, and NVR5416E, each with specific firmware version limitations.

Impact

Exploitation of this vulnerability allows for OS command injection, where an attacker can execute arbitrary commands on the device's operating system.

Remediation

Users are advised to update the firmware to a version that addresses this vulnerability. Please refer to the official advisory M00175 for guidance on the update process.