PT-2025-9719 · Edimax · Edimax Ic-7100
Published
2025-03-04
·
Updated
2025-10-30
·
CVE-2025-1316
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Edimax IC-7100 (affected versions not specified)
Description
The Edimax IC-7100 network camera has a significant security flaw that allows remote code execution on the device via a specially crafted request. This operating system command injection vulnerability can be exploited by threat actors to execute remote code on devices. The earliest known exploitation attempt was recorded in May 2024, despite the proof-of-concept exploit being publicly available since June 2023. Affected devices are vulnerable due to their reliance on default security credentials, which makes them easy targets for cybercriminals. The exploit targets a specific endpoint within the camera's software framework and has been linked to the deployment of multiple Mirai botnet variants that conduct DDoS attacks using compromised devices.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disconnecting the Edimax IC-7100 camera from the internet or replacing it with a device that is actively supported and patched by the vendor to minimize the risk of exploitation. Additionally, users can restrict access to the camera's network interface and place it behind a firewall to reduce the attack surface. It is also recommended to change the default credentials and limit access to the device to prevent unauthorized access.
RCE
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Edimax Ic-7100