{"id":10385,"date":"2025-03-17T14:08:45","date_gmt":"2025-03-17T14:08:45","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/edimax-camera-flaw-exploited\/"},"modified":"2025-03-17T14:08:47","modified_gmt":"2025-03-17T14:08:47","slug":"edimax-camera-flaw-exploited","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/edimax-camera-flaw-exploited\/","title":{"rendered":"Edimax Camera Flaw Exploited"},"content":{"rendered":"\n<\/p>\n

Unpatched Edimax Network Camera Vulnerability Exploited by Mirai Botnet<\/h2>\n

\ue802<\/i>Mar 17, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Botnet \/ Vulnerability<\/span><\/p>\n

Exploitation of Edimax IC-7100 Network Camera<\/h2>\n
\n
\n<\/p>\n

<\/a>\n<\/div>\n

A previously unpatched security vulnerability in the Edimax IC-7100 network camera has been exploited by malicious actors to deliver Mirai botnet malware variants since at least May 2024.<\/p>\n

The vulnerability, identified as CVE-2025-1316<\/a> (CVSS v4 score: 9.3), is a critical operating system command injection flaw. An attacker can exploit this vulnerability to achieve remote code execution on susceptible devices by means of a specially crafted request.<\/p>\n

According to the web infrastructure and security company Akamai, the earliest exploit attempt targeting this flaw dates back to May 2024. Although a proof-of-concept (PoC) exploit has been publicly available<\/a> since June 2023.<\/p>\n

## Technical Details of the Exploit<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

The exploit targets the \/camera-cgi\/admin\/param.cgi endpoint in Edimax devices and injects commands into the NTP_serverName option as part of the ipcamSource option of param.cgi, according to Akamai researchers Kyle Lefton and Larry Cashdollar, who said<\/a>.<\/p>\n

While exploiting the endpoint requires authentication, it has been found that the exploitation attempts are making use of default credentials (admin:1234) to obtain unauthorized access.<\/p>\n

At least two different Mirai botnet variants have been identified as exploiting the vulnerability. One of them also incorporates anti-debugging functionality prior to running a shell script that retrieves the malware for different architectures.<\/p>\n

## Impact and Goals of the Exploitation<\/p>\n

The ultimate goal of these campaigns is to corral the infected devices into a network capable of orchestrating distributed denial-of-service (DDoS) attacks against targets of interest over TCP and UDP protocols.<\/p>\n

\n
\n\"Mirai
\n<\/a>\n<\/div>\n

Furthermore, the botnets have been observed exploiting CVE-2024-7214, which affects TOTOLINK IoT devices, and CVE-2021-36220, as well as a Hadoop YARN vulnerability.<\/p>\n

## Response from Edimax<\/p>\n

In an independent advisory published last week, Edimax said<\/a> that the CVE-2025-1316 affects legacy devices that are no longer actively supported. Edimax stated that it has no plans to provide a security patch since the model was discontinued over 10 years ago.<\/p>\n

## Recommendations for Users<\/p>\n

\n

\n
\n\"Cybersecurity\"\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Unpatched Edimax Network Camera Vulnerability Exploited by Mirai Botnet \ue802Mar 17, 2025\ue804Ravie LakshmananBotnet \/ Vulnerability Exploitation of Edimax IC-7100 Network Camera A previously unpatched security vulnerability in the Edimax IC-7100…<\/p>\n","protected":false},"author":19,"featured_media":10386,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-10385","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/03\/camera.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10385","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=10385"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10385\/revisions"}],"predecessor-version":[{"id":10387,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10385\/revisions\/10387"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/10386"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=10385"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=10385"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=10385"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}