PT-2025-9719 · Edimax · Edimax Ic-7100
CVE-2025-1316
·
Publicado
2025-03-04
·
Atualizado
2025-10-30
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Edimax IC-7100 (affected versions not specified)
Description
The Edimax IC-7100 network camera has a significant security flaw that allows remote code execution on the device via a specially crafted request. This operating system command injection vulnerability can be exploited by threat actors to execute remote code on devices. The earliest known exploitation attempt was recorded in May 2024, despite the proof-of-concept exploit being publicly available since June 2023. Affected devices are vulnerable due to their reliance on default security credentials, which makes them easy targets for cybercriminals. The exploit targets a specific endpoint within the camera's software framework and has been linked to the deployment of multiple Mirai botnet variants that conduct DDoS attacks using compromised devices.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disconnecting the Edimax IC-7100 camera from the internet or replacing it with a device that is actively supported and patched by the vendor to minimize the risk of exploitation. Additionally, users can restrict access to the camera's network interface and place it behind a firewall to reduce the attack surface. It is also recommended to change the default credentials and limit access to the device to prevent unauthorized access.
RCE
OS Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Edimax Ic-7100