Loading story…
Akamai’s Security Intelligence and Response Team (SIRT) disclosed a critical remote command injection vulnerability in Vivotek legacy IP camera firmware tracked as CVE-2026-22755 (reported CVSS 9.3). The flaw enables unauthenticated attackers to execute arbitrary commands as root by abusing the camera’s file upload handling in the upload_map.cgi CGI endpoint, where a user-controlled filename is incorporated into a formatted string and then passed to a shell via system() without proper sanitization, allowing shell metacharacter injection (e.g., ;).
Technical reporting indicates exploitation hinges on crafting an upload that satisfies several implementation constraints (e.g., upload size limits and firmware validation behaviors) and invoking the upload path in a way that preserves required environment variables; researchers demonstrated command execution by embedding commands in the filename and observing uid=0 output. The issue reportedly impacts dozens of models (36 cited) across multiple Vivotek product lines and is amplified by findings that some affected legacy devices may ship or operate without passwords set by default, increasing the likelihood of opportunistic compromise and downstream abuse (e.g., botnet recruitment and DDoS activity) in environments still running legacy surveillance infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Public reporting revealed that many affected legacy Vivotek cameras may ship without passwords, making exploitation likely unauthenticated in many cases. Additional technical analysis and a proof of concept showed attackers could inject commands through POST_FILE_NAME during firmware upload, affecting 36 legacy camera models and enabling full device compromise and botnet abuse.
Akamai SIRT disclosed CVE-2026-22755, a critical remote command injection vulnerability in legacy Vivotek surveillance camera firmware. The flaw in upload_map.cgi allows arbitrary command execution via unsanitized filenames passed to a system shell, potentially yielding root access on affected devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos disclosed newly patched vulnerabilities in **GeoVision** products as part of a broader third-party advisory covering WolfSSL, GeoVision, and VTK-DICOM. The GeoVision portion spans **14 advisories and 37 CVEs**, including weaknesses such as OS command injection, privilege escalation, reflected XSS, guessable session cookies, insufficient encryption, lack of authentication, and buffer-handling flaws. Talos said the affected vendors have released patches and noted that **Snort coverage** is available to help detect exploitation attempts. Reporting on the GeoVision issues highlighted critical flaws in **LPC2011/LPC2211** license-plate recognition cameras and **GV-VMS** software. In particular, `CVE-2026-42364` is an OS command injection in `DdnsSetting.cgi` on camera firmware `1.10`, and `CVE-2026-42368` is a privilege-escalation bug that can be chained for full **root compromise** through the web interface; a separate flaw, `CVE-2026-42369`, enables unauthenticated remote code execution in **GV-VMS V20**. Because the cameras are commonly deployed in parking, checkpoint, hospital, airport, and other physical-security environments, successful exploitation could provide a foothold for lateral movement, surveillance disruption, and access into adjacent building-management or access-control networks.
Jul 10, 2026
TP-Link patched a high-severity authentication bypass vulnerability in its *VIGI* surveillance camera product line that allows an attacker with **local network (LAN) access** to reset the administrator password and take full control of affected devices. Tracked as **CVE-2026-0629** (CVSS v4.0 **8.7**), the issue is in the cameras’ local web interface **password recovery** workflow, where improper reliance on **client-side state** enables password reset without verification, requiring no privileges or user interaction. Successful exploitation can enable attackers to access or manipulate live/recorded video, change configurations, disable security features, and potentially use compromised cameras as a pivot for lateral movement or botnet/DDoS activity. Reporting attributes the discovery to **Arko Dhar (Redinent Innovations)** and notes broad model impact across VIGI C and VIGI InSight lines (reported as 28 series in one account and 32+ models in another); one researcher assessment identified **2,500+ internet-exposed** potentially vulnerable devices from checks of a single model, suggesting wider exposure where cameras are reachable from the internet despite the LAN-oriented attack vector.
Jun 29, 2026
CISA published an ICS advisory for **CVE-2026-40624**, a critical flaw affecting multiple AVer PTC camera models, including the **PTC500S, PTC115, PTC500+, and PTC115+**. The vulnerability stems from improper input validation and can allow a remote, unauthenticated attacker to achieve arbitrary code execution via a specially crafted web request. The issue is rated **Critical**, with a **CVSS v3.1 score of 9.8** and a **CVSS v4.0 score of 9.3**, and all listed versions of the affected products were reported as vulnerable. CISA said it had no reports of public exploitation targeting the flaw at the time of publication, but urged organizations to reduce internet exposure of control system devices, isolate affected networks, and use secure remote access methods such as fully updated VPNs. Additional mitigation guidance calls for updating camera firmware to the latest available version and applying vendor-provided security patches as they become available.
Jul 12, 2026