Exploitation of the flaw has gone on for many months.
Edimax IP cameras have been targeted by numerous Mirai-based botnets since May.
According to SC US, those cameras affected by the critical command injection zero-day, tracked as CVE-2025-1316, may have been victim to sustained attacks for almost a year.
Initial exploitation of the flaw in May was followed by a months-long pause, before surging in September to the start of 2025. However the availability of a proof-of-concept exploit since June 2023 suggests earlier attack attempts, according to an analysis from Akamai.
Observed intrusions by the Mirai-based botnets involved the targeting of devices with default credentials to facilitate Mirai deployment, with one of the detected botnets also abusing an unpatched Totolink product flaw.
Written by
Dan Raywood is a B2B journalist with 25 years of experience, including covering cybersecurity for the past 17 years. He has extensively covered topics from Advanced Persistent Threats and nation-state hackers to major data breaches and regulatory changes.
He has spoken at events including 44CON, Infosecurity Europe, RANT Forum, BSides Scotland, Steelcon and the National Cyber Security Show, and served as editor of SC Media UK, Infosecurity Magazine and IT Security Guru. He was also an analyst with 451 Research and a product marketing lead at Tenable.
