---
title: "Edimax IC-7100 CVE-2025-1316: Unfixable Camera RCE"
url: https://erroneo.us/security/briefs/edimax-ic-7100-cve-2025-1316-command-injection/
description: "Mirai botnets exploit a command injection in the long-discontinued Edimax IC-7100 IP camera. Edimax will not patch it. Find these cameras and replace them."
type: security-brief
section: "Security Digest"
date_published: 2025-03-04
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-1316"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Edimax IC-7100 CVE-2025-1316: Unfixable Camera RCE

**Verdict: Check exposure.** Few organizations still run this decade-old camera, but there is no fix and botnets are hunting for it; if you find one, take it off the network and replace it.

- **Who must act:** Anyone with an Edimax IC-7100, or other old Edimax IP cameras, in offices, shops, labs or remote workers' homes, especially if reachable from the internet.
- **Who can relax:** Organizations with no Edimax cameras; the flaw is specific to Edimax camera firmware.
- **Affected:** Edimax IC-7100 IP camera, all versions (discontinued more than 10 years ago); Akamai says vulnerable devices and firmware go beyond this model
- **Fixed:** None; Edimax says no patch or firmware update can be provided; Replace the device
- **CVEs:** CVE-2025-1316
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Search offices, branch sites, labs and home-office kits for Edimax IC-7100 and other old Edimax IP cameras.
2. Replace any IC-7100; Edimax will not fix it and the KEV entry says to discontinue use.
3. Until it is removed, block all internet access to the camera and isolate it on its own network segment.
4. Change the default admin password, since every attack Akamai observed used default credentials.
5. Block the botnet IPs and domains from Akamai's report at your egress firewall.

### How to check if you are affected

- Search web, proxy or IDS logs for requests to /camera-cgi/admin/param.cgi with NTP_serverName values containing shell characters, wget or curl.
- Look for camera traffic to angela.spklove.com, cnc.merisprivate.net, bot.merisprivate.net, cnc.ziparchive.xyz or virtuehub.one.
- Treat unexplained outbound floods or scanning from a camera as a likely Mirai infection and pull the device.

## What happened

On March 4, 2025, CISA published ICS advisory [ICSA-25-063-08](https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08) for CVE-2025-1316, an OS command injection in the Edimax IC-7100 network camera. All versions are affected. CISA, the CNA, scores it CVSS 3.1 9.8 and CVSS 4.0 9.3, and notes that public exploits exist. Akamai's Security Intelligence Response Team reported it. The advisory says Edimax did not respond to CISA's attempts to coordinate.

[Akamai's write-up](https://www.akamai.com/blog/security-research/2025/mar/march-edimax-cameras-command-injection-mirai), published March 13, 2025, explains what attackers do. They send a request to `/camera-cgi/admin/param.cgi` and put shell commands in the `NTP_serverName` setting. The injected command moves to `/tmp`, downloads a script such as `curl.sh` or `wget.sh`, and runs Mirai binaries for several CPU types. Akamai tracked two Mirai botnets using the bug. Between them, they also go after TOTOLINK routers, exposed Docker APIs and Hadoop YARN. A proof of concept dates to June 2023. Akamai's honeypots logged the first attempts in May 2024 and the activity drew its attention in October 2024.

On March 10, 2025, Edimax issued a [statement](https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/). It said the IC-7100 was "discontinued over 10 years ago," support and firmware maintenance have ended, and the development environment and source code are unavailable. So "no security patch or firmware update can be provided." On March 19, 2025, CISA added the CVE to its [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1316). It warned that the product may be end-of-life and that users should stop using it. The federal deadline was April 9, 2025.

## Who is affected

Every Edimax IC-7100, per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-1316). Akamai warns that "the full scope of vulnerable devices and firmware goes beyond just this model," so treat other old Edimax IP cameras as suspect too. We found no published list of other affected models as of October 23, 2026.

## Do you really need to act?

Most organizations will not find one of these cameras. If you do, act, because nothing will fix it. One detail matters. CISA's score assumes no login is needed, but Akamai says "this exploit requires authentication." Every attempt it saw used default credentials, typically `admin:1234`. A changed password blocks the attacks seen so far. It is not a fix: the injection flaw remains, and the camera gets no other security updates. Akamai's samples include UDP and TCP flood attacks, so an infected camera turns your network into a source of attack traffic. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-1316) also rates it 9.8.

## What to do now

1. Inventory cameras in offices, shops, labs and home-office kits, and flag any Edimax IC-7100 or other old Edimax model.
2. Replace them with supported cameras. Do not wait for firmware that Edimax says will never come.
3. Until a camera is removed, block internet access to it, put it on an isolated segment and change the default password.
4. Scan your public ranges for exposed camera web interfaces, for example `nmap -Pn -p 80,8080 <public-range>`, and close what you find.

## How to tell if you were hit

- Search web, proxy or IDS logs for requests to `/camera-cgi/admin/param.cgi` with `NTP_serverName` values containing shell characters, `wget` or `curl`.
- Look for camera traffic to Akamai's published C2 domains, including `angela.spklove.com`, `cnc.merisprivate.net` and `cnc.ziparchive.xyz`.
- Unexplained outbound floods or scanning from a camera point to infection. Disconnect it.

## Timeline

- Jun 2023 — Earliest proof of concept, per Akamai.
- May 2024 — First exploit attempts in Akamai honeypots.
- Mar 4, 2025 — CISA publishes ICSA-25-063-08; CVE-2025-1316 is published.
- Mar 10, 2025 — Edimax says it cannot provide a patch.
- Mar 13, 2025 — Akamai publishes its botnet analysis.
- Mar 19, 2025 — CISA adds the CVE to KEV; federal deadline Apr 9, 2025.

## Sources

1. [CISA — ICSA-25-063-08: Edimax IC-7100 IP Camera](https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08)
2. [Edimax — Official Statement on CVE-2025-1316](https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/)
3. [Akamai SIRT — CVE-2025-1316: Mirai botnets exploit Edimax camera command injection](https://www.akamai.com/blog/security-research/2025/mar/march-edimax-cameras-command-injection-mirai)
4. [CVE record — CVE-2025-1316](https://www.cve.org/CVERecord?id=CVE-2025-1316)
5. [NVD — CVE-2025-1316](https://nvd.nist.gov/vuln/detail/CVE-2025-1316)
6. [CISA — Known Exploited Vulnerabilities: CVE-2025-1316](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1316)

---
Source page: https://erroneo.us/security/briefs/edimax-ic-7100-cve-2025-1316-command-injection/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt