CVE-2026-0854

Merit LILIN｜NVR - OS Command Injection

State: Published
Severity: 8.7 High
Published: Jan 12, 2026
Updated: Jan 12, 2026
Reserved: Jan 12, 2026

Description

Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	twcert
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
DH032Merit LILIN	1.0.28.3858 and earlierAffected
DVR708Merit LILIN	1.3.4 and earlierAffected
DVR716Merit LILIN	1.3.4 and earlierAffected
DVR804Merit LILIN	1.3.4 and earlierAffected
DVR808Merit LILIN	1.3.4 and earlierAffected
DVR816Merit LILIN	1.3.4 and earlierAffected
NVR100LMerit LILIN	1.1.66 and earlierAffected
NVR200LMerit LILIN	1.1.66 and earlierAffected
NVR400LMerit LILIN	1.1.66 and earlierAffected
NVR1400LMerit LILIN	1.1.66 and earlierAffected
NVR2400LMerit LILIN	1.1.66 and earlierAffected
NVR3216Merit LILIN	2.0.74.3921 and earlierAffected
NVR3416Merit LILIN	2.0.74.3921 and earlierAffected
NVR3416rMerit LILIN	2.0.74.3921 and earlierAffected
NVR3816Merit LILIN	2.0.74.3921 and earlierAffected
NVR5832Merit LILIN	4.0.24.4043 and earlierAffected
NVR5832SMerit LILIN	4.0.24.4043 and earlierAffected
NVR5104EMerit LILIN	4.0.24.4078 and earlierAffected
NVR5208EMerit LILIN	4.0.24.4078 and earlierAffected
NVR5416EMerit LILIN	4.0.24.4078 and earlierAffected

References

https://www.twcert.org.tw/tw/cp-132-10624-6599c-1.htmlthird-party-advisory
https://www.twcert.org.tw/en/cp-139-10623-4f523-2.htmlthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.