CVE-2026-0855

Certain IP Camera models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

Score

CVSS 3.1 8.8 High

Status

Deferred - twcert@cert.org.tw

Published

2026-01-12

Last modified

2026-01-16

Weaknesses

CWE-78

Affected products

• Ipd (Merit Lilin)
• Ipr (Merit Lilin)
• Ld (Merit Lilin)
• Lr (Merit Lilin)
• P2 (Merit Lilin)
• P3 (Merit Lilin)
• P6 (Merit Lilin)
• V1 (Merit Lilin)
• Z7 (Merit Lilin)

References

• https://www.twcert.org.tw/en/cp-139-10626-afbe2-2.html
• https://www.twcert.org.tw/tw/cp-132-10625-fac5c-1.html