Cyber

What changed

A significant security vulnerability has been detected in the reviewdog/action-setup GitHub Action. On March 11, 2025, the action was compromised, leading to the injection of malicious code that can dump sensitive secrets into GitHub Actions Workflow Logs.

This vulnerability affects not only the compromised action but also other related reviewdog actions, regardless of their version or pinning methods.

Who is affected

The vulnerability impacts various users and products associated with reviewdog GitHub Actions. Organizations utilizing these actions should be particularly vigilant.

The following products and actions are affected by this vulnerability:

• reviewdog/action-setup
• reviewdog/action-shellcheck
• reviewdog/action-composite-template
• reviewdog/action-staticcheck

What to do

Organizations using the affected reviewdog actions should take immediate action to mitigate risks. It is crucial to review workflows and logs for any exposed secrets.

Consider the following steps to enhance security:

• Remove or disable the affected actions from workflows until a patch is available.
• Audit GitHub Actions Workflow Logs for any unauthorized access or data exposure.
• Implement additional security measures, such as secret scanning and monitoring for unusual activity.

What changed

A significant OS command injection vulnerability has been discovered in the Edimax IC-7100 IP camera. This flaw arises from inadequate input sanitization, which could enable an attacker to execute arbitrary commands remotely through specially crafted requests.

• The vulnerability may lead to unauthorized access and control over the affected device.
• Potential for exploitation increases if the device is connected to a broader network.

Who is affected

The vulnerability primarily impacts users of the Edimax IC-7100 IP camera, which may be at the end of its service life. Organizations utilizing this product should be particularly vigilant.

Given the nature of the vulnerability, any environment where the camera is deployed could be at risk.

• Users of Edimax IC-7100 IP cameras.
• Organizations relying on IP surveillance systems.
• Potentially any network where the camera is integrated.

What to do

It is strongly advised that users discontinue the use of the Edimax IC-7100 IP camera, especially if it is confirmed to be end-of-life or end-of-service. Immediate action is necessary to mitigate risks associated with this vulnerability.

For those still using the device, consider isolating it from critical network segments and monitoring for any suspicious activity.

• Discontinue use of the Edimax IC-7100 IP camera.
• Isolate the device from sensitive networks.
• Monitor network traffic for unusual patterns.