CVE-2025-1316: Edimax IC-7100 IP camera OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityRemote unauthenticated RCE with a CVSS 9.3 score and confirmed exploitation in CISA KEV.

What it is

The Edimax IC-7100 IP camera fails to neutralize specially crafted requests, allowing OS command injection. A remote, unauthenticated attacker can exploit this to run arbitrary code on the device, and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker gains remote code execution on the camera, enabling full compromise of the device and any data or network access it holds.

Attack surface

Reachable over the network via crafted HTTP requests to the device; the CVSS vector shows no privileges or user interaction required.

Exploitation

Listed in CISA KEV (added 2025-03-19) and EPSS probability is 0.74482 (99.5th percentile), indicating active exploitation is expected.

What to do

• Apply the vendor mitigation per CISA ICS advisory ICSA-25-063-08 or discontinue use of the device if no fix is available.
• Isolate cameras on a segmented VLAN with no internet exposure and restrict management access to trusted hosts.
• Block inbound access to the device from untrusted networks and disable unused services.
• Monitor for and replace end-of-life IC-7100 units that cannot be patched.

Detection

• Inspect HTTP request logs to the camera for command-injection patterns (shell metacharacters, encoded payloads) in parameters.
• Alert on unexpected outbound connections or new processes on the camera or its network segment.
• Monitor for anomalous authentication or configuration changes on the device.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.