CVE-2025-1316

The Edimax IC-7100 device does not properly sanitize data contained in incoming network requests (CWE-78 – OS command injection). An attacker can craft a specially constructed request and send it to the device without any authentication. The injected commands are then executed with the privileges of the process handling the request at the operating system level of the device.

An attacker gains the ability to remotely execute arbitrary code (RCE) on the device without needing any credentials, which can result in complete takeover of the camera, its reconfiguration, or inclusion in a botnet.

Apply patches available from the manufacturer according to the references provided. If no update is available, CISA recommends isolating the device from the public network, placing it behind a firewall, and restricting network access to a minimum. Detailed recommendations are contained in advisory ICSA-25-063-08.

Edimax IC-7100 devices with their firmware. Specific firmware versions are indicated in the CISA ICS-CERT advisory ICSA-25-063-08.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.