CVE-2025-1316criticalunder attackCWE-78

CVE-2025-1316: critical vulnerability in Edimax IC-7100 IP Camera

Edimax IC-7100 IP Camera OS Command Injection

Published · Updated

Follow this CVE+ Monitor IC-7100 IP Camera

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

80Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.3epss 74%
from disclosure to weapon
Published on NVDMar 4
CISA KEV+15d
Action required by CISAfederal deadline: 2025-04-09

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

The Edimax IC-7100 camera fails to properly validate user input, allowing attackers to inject malicious commands that execute with the device's privileges. This can lead to complete compromise of the camera and any network it's connected to.

Technical detail

CWE-78 OS command injection vulnerability in Edimax IC-7100 allows unauthenticated remote code execution through improperly sanitized request parameters. The device fails to neutralize shell metacharacters, enabling arbitrary command execution with device privileges; exploitation requires network access to the device's web interface.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Edimax · IC-7100 IP Camera