Certain Merit LILIN IP Camera models are vulnerable to operating‑system command injection. An attacker who has authenticated access to the device can supply arbitrary commands that the host operating system will execute, potentially giving the attacker full control of the camera and its underlying system. The weakness is a classic OS command injection flaw (CWE-78).

The affected product family includes Merit LILIN IPD, IPR, LD, LR, P2, P3, P6, V1, and Z7. The IPD, IPR, LD, and LR models are no longer supported and should be replaced. All remaining models are still supported but must receive the firmware update identified in advisory M00176.

The CVSS score of 8.7 indicates a high severity; however, the EPSS score is less than 1%, reflecting a very low likelihood of exploitation observed to date. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated remote access, suggesting the attack vector is network‑based against the management interface. While the exploitation probability is low, the impact of successful exploitation is complete control over the device.