CVE-2025-1316KEV · OVERDUECWE-78

Edimax IC-7100 IP Camera OS Command Injection

Critical · published March 4, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.3. It is confirmed in active exploitation. It sits in the 99.5th percentile for exploit probability.

563
days past CISA
deadline
CVSS v4.0
9.3
EPSS
74%
Percentile
99.5
In the wild
Confirmed
What it is

🚨 A crafty request is all it takes to seize control of your Edimax IC-7100! This vulnerability allows attackers to remotely run code on your device, and it’s absolutely devastating. 🔥 Think of it as a delivery driver who doesn’t verify the address on the package; they deliver sensitive orders to anyone who asks. They could be handing over the keys to your entire home network without you ever knowing! An attacker could exploit this vulnerability to execute arbitrary code on the device, gaining full control. This means they could manipulate your security cameras, access sensitive information, or even turn the device into a part of a botnet. The stakes are incredibly high if left unaddressed!

Put simply

Think of it as a delivery driver who doesn’t verify the address on the package; they deliver sensitive orders to anyone who asks. They could be handing over the keys to your entire home network without you ever knowing! This vulnerability arises due to the Edimax IC-7100 failing to neutralize specially crafted requests. An attacker can send these requests to execute malicious code remotely, bypassing standard security measures entirely.

What to do

An attacker could exploit this vulnerability to execute arbitrary code on the device, gaining full control. This means they could manipulate your security cameras, access sensitive information, or even turn the device into a part of a botnet. The stakes are incredibly high if left unaddressed! To secure your device, immediately update to the latest firmware version provided by Edimax. Review your network settings and disable remote access if it’s not in use. Regularly check for updates and monitor logs for any suspicious activity. You've got this! Follow these steps, and you'll ensure your device is back in safe hands in no time! 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.74482 · 99.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-03-04T23:36Z
KEV added
2025-03-19 · due 2025-04-09
EPSS history
Timeline
  • 19 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 9
    kev
  • 04 MAR 23:36Z
    Edimax IC-7100 IP Camera OS Command Injection
    cvelistv5