{"id":"CVE-2025-1316","published":"2025-03-05T00:15:35Z","modified":"2026-06-17T08:38:54Z","title":"Edimax IC-7100 IP Camera OS Command Injection Vulnerability","vendor":"Edimax","product":"IC-7100 IP Camera","tier":"core","eol":null,"description":{"text":"Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device","provenance":"source","from":"NVD"},"summary":{"text":"The Edimax IC-7100 IP Camera contains an OS command injection flaw, in which the device fails to properly neutralize specially crafted requests. An attacker who can send such requests to the camera over the network, with no authentication or user interaction required, can achieve remote code execution on the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:54Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.74482,"percentile":0.99492,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-03-19","dueDate":"2025-04-09","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-1316","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-03-07","exploitedFirstSeen":"2025-03-07","ransomware":false,"evidence":[{"url":"https://www.securityweek.com/edimax-camera-zero-day-disclosed-by-cisa-exploited-by-botnets/","date":"2025-03-07"},{"url":"https://www.akamai.com/blog/security-research/march-edimax-cameras-command-injection-mirai","date":"2025-03-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-03-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-03-22&host_type=src&vulnerability=cve-2025-1316","date":"2025-03-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-03-23&host_type=src&vulnerability=cve-2025-1316","date":"2025-03-23"},{"url":"https://cyble.com/resources/research-reports/global-cybersecurity-report/","date":"2025-12-11"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","date":"2026-02-25"},{"url":"https://partner.wavestore.com/sites/partner_wavestore_com/files/2026-03/The%20State%20of%20Video%20Network%20Cybersecurity%20-%20Research%20Report%202026%20-%20Wavestore.pdf","date":"2026-03-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-05-21&host_type=src&vulnerability=cve-2025-1316","date":"2026-05-21"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08","tags":["Mitigation","Third Party Advisory","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1316","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Execution","mappingType":"exploitation_technique","evidence":[],"comment":"Due to improper input sanitization, the web interface of the Edimax IC-7100 contains a vulnerability that allows for a user to send a crafted HTTP request containing a malicious command(s), which the camera's OS can be forced to execute.","confidence":"high"},{"id":"T1055","name":"Process Injection","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Execution","mappingType":"primary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-6192","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6192","exploited":true,"exploitedSince":"2025-03-19","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1055"],"provenance":"source"}],"timeline":[{"date":"2025-03-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1316","provenance":"source"},{"date":"2025-03-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.securityweek.com/edimax-camera-zero-day-disclosed-by-cisa-exploited-by-botnets/","provenance":"source"},{"date":"2025-03-19","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-03-19","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6192","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":14},"priority":{"score":64.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 602 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.9,"detail":"percentile 0.9949"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}