CVE-2025-1316
Edimax IC-7100 IP Camera OS Command Injection Vulnerability
Description
CVE-2025-1316 is a critical OS command injection vulnerability in the Edimax IC-7100 IP Camera that allows unauthenticated remote attackers to execute arbitrary commands on the device. The camera fails to properly neutralize specially crafted requests, enabling full remote code execution without any authentication. With a CVSS v3.1 score of 9.8 (Critical) and an EPSS score of 84.88% at the 99.3rd percentile, this vulnerability is among the most likely to be exploited. CISA has added CVE-2025-1316 to the Known Exploited Vulnerabilities catalog, and all firmware versions of the Edimax IC-7100 are affected with no known patch available.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| edimax | ic-7100 firmware | All versions |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08(Mitigation, Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1316(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-1316 is classified under CWE-78 (OS Command Injection), a vulnerability that occurs when software constructs OS commands using externally-influenced input without properly neutralizing shell metacharacters. In the Edimax IC-7100 IP camera, the device's web interface incorporates user-supplied input into system-level commands without sanitization, allowing attackers to inject and execute arbitrary operating system commands. OS command injection consistently ranks among the most dangerous software weaknesses due to its direct path to full system compromise.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2025-1316 has maximum impact across all security dimensions. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N), and needs no user interaction (UI:N). Confidentiality (High) is fully compromised as attackers can execute commands to access the camera's video and audio feeds, extract stored credentials, and read configuration data including Wi-Fi passwords and network settings. Integrity (High) is impacted because attackers can modify the device firmware, install persistent malware, alter camera settings, and use the compromised device as a pivot point for attacking other devices on the network. Availability (High) is at risk as the attacker can disable the camera, recruit it into a botnet for DDoS attacks, or render it permanently inoperable. The EPSS score of 84.88% at the 99.3rd percentile reflects that IoT devices with command injection vulnerabilities are prime targets for botnet operators and are frequently mass-exploited within days of disclosure.
Exploit Maturity
CVE-2025-1316 has confirmed active exploitation, as CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 9, 2025. The CISA ICS advisory ICSA-25-063-08 provides detailed mitigation guidance. The EPSS score of 84.88% at the 99.3rd percentile confirms near-certain exploitation activity. All firmware versions of the Edimax IC-7100 are affected with no available patch, making this a permanent vulnerability for existing deployments. IoT cameras with command injection flaws are aggressively targeted by Mirai-variant botnets and other automated exploitation frameworks that scan the internet for vulnerable devices and recruit them within minutes of discovery.
Remediation
-
Discontinue use of the Edimax IC-7100 if possible, as all firmware versions are affected and no patch is available. CISA recommends applying mitigations per vendor instructions or discontinuing use of the product if mitigations are unavailable.
-
Isolate the camera from the internet immediately by removing any port forwarding rules, UPnP mappings, or direct internet exposure. Place the device on a dedicated IoT VLAN with strict firewall rules that block inbound connections from untrusted networks.
-
Implement network-level access controls to restrict management interface access to specific trusted IP addresses on the local network. Disable any remote access features, cloud connectivity, or P2P connection capabilities on the device.
-
Monitor network traffic from the camera for indicators of compromise including outbound connections to unknown IP addresses, unusual DNS queries, high-volume traffic patterns indicative of DDoS participation, or connections to known command-and-control infrastructure.
-
Plan for device replacement with a camera from a vendor that provides regular security updates and has a responsible vulnerability disclosure program. Ensure replacement devices support encrypted communications and do not expose management interfaces without authentication.
Technical Details
CVE-2025-1316 is an OS command injection vulnerability affecting all firmware versions of the Edimax IC-7100 IP camera. The device's web interface does not properly neutralize user-supplied input in HTTP requests, allowing an attacker to inject shell metacharacters that are interpreted by the underlying operating system. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates the attack is network-accessible, requires no authentication or user interaction, and achieves complete compromise of confidentiality, integrity, and availability. The embedded Linux operating system typical of IoT cameras provides a full command execution environment, meaning successful exploitation grants the attacker the ability to download and execute malware, establish reverse shells, modify firmware, and recruit the device into botnets. The absence of any available firmware patch makes this a permanent vulnerability for the Edimax IC-7100 product line.
Frequently Asked Questions
Is CVE-2025-1316 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2025-1316 by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 84.88% at the 99.3rd percentile indicates extremely high exploitation activity, consistent with IoT botnets aggressively targeting vulnerable cameras.
What products are affected by CVE-2025-1316?
All firmware versions of the Edimax IC-7100 IP camera are affected. There is no known patch available from the vendor, meaning every deployed IC-7100 unit is permanently vulnerable.
How do I fix CVE-2025-1316?
There is no firmware patch available. CISA recommends discontinuing use of the product or isolating it from untrusted networks. Remove any internet-facing exposure and place the camera on a segmented network with strict access controls.
How severe is CVE-2025-1316?
CVE-2025-1316 is rated Critical with a CVSS score of 9.8. It allows unauthenticated remote code execution on all firmware versions with no available fix, making it one of the most dangerous IoT vulnerabilities currently tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.