Unpatched Edimax Camera Flaw Exploited for Mirai Botnet Attacks Since Last Year
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-7214 | A vulnerability has been found in TOTOLINK LR350 9.3.5u.6369_B20220309 and classified as critical. A vulnerability has been found in TOTOLINK LR350 9.3.5u.6369_B20220309 and classified as critical. Affected by this vulnerability is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272785 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. NVD description · AI analysis pending | 5.3 | 3% | PoC |
| — | |
| CVE-2025-1316 | Unauthenticated OS Command Injection RCE in Edimax IC-7100 IP Camera CVE-2025-1316 is an OS command injection flaw (CWE-78) in the Edimax IC-7100 IP camera that fails to properly neutralize requests it receives. Because the request handling is reachable over the network without authentication or user interaction (per the CVSS 4.0 vector), an unauthenticated attacker can send specially crafted requests to the device. Successful exploitation yields full remote code execution on the camera, with high impact on confidentiality, integrity, and availability of the device itself. Only deployments using the Edimax IC-7100 camera and its firmware are affected. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-03-19, and public reporting indicates Mirai-based botnets have been exploiting it since roughly a year before its disclosure, making it effectively a zero-day used to recruit cameras into botnets. Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use of the IC-7100 if mitigations are unavailable; check whether Edimax has released updated firmware and install it. In the meantime, reduce exposure by removing any port-forwarding or direct internet access to affected cameras, restricting management interfaces to trusted networks, and monitoring for Mirai-like scanning or traffic. Treat exploitation as likely given the high EPSS (74.5% in 30 days) and in-the-wild botnet use. | 9.3 | 74% | KEV |
| moderateapproximately 1,000-10,000 internet-exposed devices (estimated) |
Full article421 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 17, 2025Botnet / Vulnerability
An unpatched security flaw impacting the Edimax IC-7100 network camera is being exploited by threat actors to deliver Mirat botnet malware variants since at least May 2024.
The vulnerability in question is CVE-2025-1316 (CVSS v4 score: 9.3), a critical operating system command injection flaw that an attacker could exploit to achieve remote code execution on susceptible devices by means of a specially crafted request.
Web infrastructure and security company Akamai said the earliest exploit attempt targeting the flaw dates back to May 2024, although a proof-of-concept (PoC) exploit has been publicly available since June 2023.
"The exploit targets the /camera-cgi/admin/param.cgi endpoint in Edimax devices, and injects commands into the NTP_serverName option as part of the ipcamSource option of param.cgi," Akamai researchers Kyle Lefton and Larry Cashdollar said.
While weaponizing the endpoint requires authentication, it has been found that the exploitation attempts are making use of default credentials (admin:1234) to obtain unauthorized access.
At least two different Mirai botnet variants have been identified as exploiting the vulnerability, with one of them also incorporating anti-debugging functionality prior to running a shell script that retrieves the malware for different architectures.
The end goal of these campaigns is to corral the infected devices into a network capable of orchestrating distributed denial-of-service (DDoS) attacks against targets of interest over TCP and UDP protocols.
Furthermore, the botnets have been observed exploiting CVE-2024-7214, which affects TOTOLINK IoT devices, CVE-2021-36220, and a Hadoop YARN vulnerability.
In an independent advisory published last week, Edimax said the CVE-2025-1316 affects legacy devices that are no longer actively supported and that it has no plans to provide a security patch since the model was discontinued over 10 years ago.
Given the absence of an official patch, users are advised to either upgrade to a newer model, or avoid exposing the device directly over the internet, change the default admin password, and monitor access logs for any signs of unusual activity.
"One of the most effective ways for cybercriminals to start assembling a botnet is to target poorly secured and outdated firmware on older devices," Akamai said.
"The legacy of Mirai continues to plague organizations worldwide as the propagation of Mirai malware–based botnets shows no signs of stopping. With all sorts of freely available tutorials and source code (and, now, with AI assistance) spinning up a botnet has become even easier."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/03/unpatched-edimax-camera-flaw-exploited.html