{"schemaVersion":3,"id":"CVE-2025-1316","aliases":[],"status":"published","duplicateOf":null,"title":"Edimax IC-7100 IP Camera OS Command Injection Vulnerability","description":"Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device","dates":{"published":"2025-03-04T23:36:59.724Z","modified":"2025-10-21T22:55:25.794Z","reserved":null,"kevAdded":["2025-03-19T00:00:00.000Z"],"kevDue":["2025-04-09T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":9.3,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":9.3,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.74482,"percentile":0.99496,"severity":"critical","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.74482},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.74482,"percentile":0.99496}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.74482,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.74482,"percentile":0.99496}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-03-19T00:00:00.000Z","dueDate":"2025-04-09T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Edimax IC-7100 IP Camera OS Command Injection Vulnerability","description":"Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","notes":[{"type":"url","href":"https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/","label":"www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-1316","label":"nvd.nist.gov/vuln/detail/CVE-2025-1316"}],"vendor":"Edimax","product":"IC-7100 IP Camera","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-03-19T00:00:00.000Z","dueDate":"2025-04-09T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Edimax IC-7100 IP Camera OS Command Injection Vulnerability","description":"Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","notes":[{"type":"url","href":"https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/","label":"www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-1316","label":"nvd.nist.gov/vuln/detail/CVE-2025-1316"}],"vendor":"Edimax","product":"IC-7100 IP Camera","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","description":"The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/78.html"}],"affected":[{"vendor":"edimax","product":"ic-7100 ip camera","name":"IC-7100 IP Camera","label":"ic-7100 ip camera","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/edimax/ic-7100_ip_camera"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08","label":"www.cisa.gov/news-events/ics-advisories/icsa-25-063-08","hostname":"www.cisa.gov","tags":["Mitigation","Third Party Advisory","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1316","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1316","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-03-04T23:36:59.724Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2025-03-19T00:00:00.000Z","label":"Added to CISA KEV","detail":"Edimax IC-7100 IP Camera OS Command Injection Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2025-04-09T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T22:55:25.794Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T06:15:04.427Z","stale":false,"partial":false}}