erroneo.us
Search all guides⌘K

Security Digest · Mar 4, 2025 · Vulnerability · Other

Edimax IC-7100 CVE-2025-1316: Unfixable Camera RCE

Mirai botnets exploit a command injection in the long-discontinued Edimax IC-7100 IP camera. Edimax will not patch it. Find these cameras and replace them.

Published By erroneo.us Security Desk · Updated 3 min read6 sources

Our verdict

Check exposure

Few organizations still run this decade-old camera, but there is no fix and botnets are hunting for it; if you find one, take it off the network and replace it.

Who must act: Anyone with an Edimax IC-7100, or other old Edimax IP cameras, in offices, shops, labs or remote workers' homes, especially if reachable from the internet.

Who can relax: Organizations with no Edimax cameras; the flaw is specific to Edimax camera firmware.

Affected
Edimax IC-7100 IP camera, all versions (discontinued more than 10 years ago)
Akamai says vulnerable devices and firmware go beyond this model
Fixed in
None; Edimax says no patch or firmware update can be provided
Replace the device
CVSS
9.8 (v3.1, CNA)
EPSS
74.5% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Search offices, branch sites, labs and home-office kits for Edimax IC-7100 and other old Edimax IP cameras.
  2. Replace any IC-7100; Edimax will not fix it and the KEV entry says to discontinue use.
  3. Until it is removed, block all internet access to the camera and isolate it on its own network segment.
  4. Change the default admin password, since every attack Akamai observed used default credentials.
  5. Block the botnet IPs and domains from Akamai's report at your egress firewall.

How to check if you are affected or compromised

  • Search web, proxy or IDS logs for requests to /camera-cgi/admin/param.cgi with NTP_serverName values containing shell characters, wget or curl.
  • Look for camera traffic to angela.spklove.com, cnc.merisprivate.net, bot.merisprivate.net, cnc.ziparchive.xyz or virtuehub.one.
  • Treat unexplained outbound floods or scanning from a camera as a likely Mirai infection and pull the device.

What happened#

On March 4, 2025, CISA published ICS advisory ICSA-25-063-08 for CVE-2025-1316, an OS command injection in the Edimax IC-7100 network camera. All versions are affected. CISA, the CNA, scores it CVSS 3.1 9.8 and CVSS 4.0 9.3, and notes that public exploits exist. Akamai's Security Intelligence Response Team reported it. The advisory says Edimax did not respond to CISA's attempts to coordinate.

Akamai's write-up, published March 13, 2025, explains what attackers do. They send a request to /camera-cgi/admin/param.cgi and put shell commands in the NTP_serverName setting. The injected command moves to /tmp, downloads a script such as curl.sh or wget.sh, and runs Mirai binaries for several CPU types. Akamai tracked two Mirai botnets using the bug. Between them, they also go after TOTOLINK routers, exposed Docker APIs and Hadoop YARN. A proof of concept dates to June 2023. Akamai's honeypots logged the first attempts in May 2024 and the activity drew its attention in October 2024.

On March 10, 2025, Edimax issued a statement. It said the IC-7100 was "discontinued over 10 years ago," support and firmware maintenance have ended, and the development environment and source code are unavailable. So "no security patch or firmware update can be provided." On March 19, 2025, CISA added the CVE to its KEV catalog. It warned that the product may be end-of-life and that users should stop using it. The federal deadline was April 9, 2025.

Who is affected#

Every Edimax IC-7100, per the CVE record. Akamai warns that "the full scope of vulnerable devices and firmware goes beyond just this model," so treat other old Edimax IP cameras as suspect too. We found no published list of other affected models as of October 23, 2026.

Do you really need to act?#

Most organizations will not find one of these cameras. If you do, act, because nothing will fix it. One detail matters. CISA's score assumes no login is needed, but Akamai says "this exploit requires authentication." Every attempt it saw used default credentials, typically admin:1234. A changed password blocks the attacks seen so far. It is not a fix: the injection flaw remains, and the camera gets no other security updates. Akamai's samples include UDP and TCP flood attacks, so an infected camera turns your network into a source of attack traffic. NVD also rates it 9.8.

What to do now#

  1. Inventory cameras in offices, shops, labs and home-office kits, and flag any Edimax IC-7100 or other old Edimax model.
  2. Replace them with supported cameras. Do not wait for firmware that Edimax says will never come.
  3. Until a camera is removed, block internet access to it, put it on an isolated segment and change the default password.
  4. Scan your public ranges for exposed camera web interfaces, for example nmap -Pn -p 80,8080 <public-range>, and close what you find.

How to tell if you were hit#

  • Search web, proxy or IDS logs for requests to /camera-cgi/admin/param.cgi with NTP_serverName values containing shell characters, wget or curl.
  • Look for camera traffic to Akamai's published C2 domains, including angela.spklove.com, cnc.merisprivate.net and cnc.ziparchive.xyz.
  • Unexplained outbound floods or scanning from a camera point to infection. Disconnect it.

Timeline#

  • — Earliest proof of concept, per Akamai.
  • — First exploit attempts in Akamai honeypots.
  • — CISA publishes ICSA-25-063-08; CVE-2025-1316 is published.
  • — Edimax says it cannot provide a patch.
  • — Akamai publishes its botnet analysis.
  • — CISA adds the CVE to KEV; federal deadline Apr 9, 2025.

Vulnerability records

  • CVE-2025-1316 · KEV 2025-03-19 · Edimax IC-7100 does not properly neutralize requests.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. CISA — ICSA-25-063-08: Edimax IC-7100 IP Camera cisa.gov
  2. Edimax — Official Statement on CVE-2025-1316 edimax.com
  3. Akamai SIRT — CVE-2025-1316: Mirai botnets exploit Edimax camera command injection akamai.com
  4. CVE record — CVE-2025-1316 cve.org
  5. NVD — CVE-2025-1316 nvd.nist.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2025-1316 cisa.gov