{"id":"CVE-2026-0854","state":"PUBLISHED","title":"Merit LILIN｜NVR - OS Command Injection","description":"Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.","publishedAt":"2026-01-12T05:58:52.175Z","updatedAt":"2026-01-12T14:56:28.862Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"twcert"},"assigner":"twcert","products":["Merit LILIN DH032","Merit LILIN DVR708","Merit LILIN DVR716","Merit LILIN DVR804","Merit LILIN DVR808","Merit LILIN DVR816","Merit LILIN NVR100L","Merit LILIN NVR200L","Merit LILIN NVR400L","Merit LILIN NVR1400L","Merit LILIN NVR2400L","Merit LILIN NVR3216","Merit LILIN NVR3416","Merit LILIN NVR3416r","Merit LILIN NVR3816","Merit LILIN NVR5832","Merit LILIN NVR5832S","Merit LILIN NVR5104E","Merit LILIN NVR5208E","Merit LILIN NVR5416E"],"affected":[{"vendor":"Merit LILIN","product":"DH032","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0.28.3858","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"DVR708","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.4","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"DVR716","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.4","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"DVR804","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.4","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"DVR808","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.4","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"DVR816","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.4","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR100L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.1.66","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR200L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.1.66","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR400L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.1.66","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR1400L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.1.66","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR2400L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.1.66","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR3216","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.74.3921","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR3416","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.74.3921","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR3416r","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.74.3921","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR3816","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.74.3921","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR5832","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.24.4043","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR5832S","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.24.4043","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR5104E","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.24.4078","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR5208E","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.24.4078","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR5416E","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.24.4078","versionType":"custom"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-10624-6599c-1.html","https://www.twcert.org.tw/en/cp-139-10623-4f523-2.html"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/0xxx/CVE-2026-0854.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-0854","state":"PUBLISHED","datePublished":"2026-01-12T05:58:52.175Z","dateUpdated":"2026-01-12T14:56:28.862Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2026-01-12T03:07:24.850Z"},"containers":{"cna":{"title":"Merit LILIN｜NVR - OS Command Injection","descriptions":[{"lang":"en","value":"Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device."}],"affected":[{"vendor":"Merit LILIN","product":"DH032","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0.28.3858","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"DVR708","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.4","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"DVR716","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.4","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"DVR804","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.4","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"DVR808","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.4","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"DVR816","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.4","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR100L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.1.66","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR200L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.1.66","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR400L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.1.66","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR1400L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.1.66","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR2400L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.1.66","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR3216","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.74.3921","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR3416","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.74.3921","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR3416r","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.74.3921","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR3816","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.74.3921","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR5832","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.24.4043","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR5832S","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.24.4043","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR5104E","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.24.4078","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR5208E","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.24.4078","versionType":"custom"}]},{"vendor":"Merit LILIN","product":"NVR5416E","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.24.4078","versionType":"custom"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-10624-6599c-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-10623-4f523-2.html","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2026-01-12T05:58:52.175Z"},"datePublic":"2026-01-12T05:48:00.000Z","impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Please refer to the official advisory(M00175) to update the firmware.<br>"}],"value":"Please refer to the official advisory(M00175) to update the firmware."}],"source":{"advisory":"TVN-202601003","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-12T14:55:41.159581Z","id":"CVE-2026-0854","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-12T14:56:28.862Z"}}]}}}