No vendor fix for exploited Edimax IC-7100 and AVTECH AVM1203 camera flaws: isolate or replace them

CISA reports network-exploitable command injection flaws in Edimax IC-7100 cameras, all versions, and AVTECH AVM1203 cameras, says neither vendor responded to coordinate fixes, and added the Edimax flaw and two GeoVision device flaws to its Known Exploited Vulnerabilities catalog. It advises keeping such devices off the internet and behind firewalls.

Source facts

CISA advisory ICSA-25-063-08, released March 4, 2025, says all versions of the Edimax IC-7100 IP camera have an OS command injection flaw, CVE-2025-1316, that lets an attacker achieve remote code execution with specially crafted requests, and that Edimax has not responded to CISA requests to coordinate. CISA added CVE-2025-1316 to its Known Exploited Vulnerabilities catalog on March 19, 2025, based on evidence of active exploitation.

Advisory ICSA-24-214-07, released August 1, 2024, says commands can be injected over the network into AVTECH AVM1203 cameras on firmware FullImg-1023-1007-1011-1009 and earlier, CVE-2024-7029, that public exploitation is known, that other AVTECH cameras and NVRs are suspected to be affected, and that AVTECH has not responded to requests to work with CISA. On May 7, 2025, CISA also added two GeoVision device OS command injection flaws, CVE-2024-6047 and CVE-2024-11120, to the catalog based on evidence of active exploitation.

For both cameras, CISA recommends minimizing network exposure so devices are not accessible from the internet, placing them behind firewalls isolated from business networks, and using more secure remote access such as updated VPNs. It says BOD 22-01 binds only federal civilian agencies but strongly urges all organizations to prioritize timely remediation of catalog vulnerabilities.

Applicability

Use this for any site with these vendors’ cameras or recorders. Check exact models and firmware against each advisory, and note CISA’s warning that other AVTECH models may be affected.

DSE recommendation

DSE recommends finding every Edimax, AVTECH and GeoVision camera or recorder on your networks and replacing units that have no vendor fix. Until replacement, remove port forwarding and any public exposure, move them to an isolated camera network without internet access, block their outbound traffic, and reach them only through the VMS or a managed VPN.

Verification

Scan camera networks for these vendors’ devices, confirm none answer from the internet with an external scan, and record a replacement date for each unit.

Official references

CISA ICS Advisory ICSA-25-063-08 — Edimax IC-7100 IP Camera. CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (March 19, 2025). CISA ICS Advisory ICSA-24-214-07 — AVTECH IP Camera. CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (May 7, 2025). Reviewed October 19, 2026.