Unauthenticated Root Command Injection in Vivotek Legacy Camera Firmware (CVE-2026-22755)

Akamai’s Security Intelligence and Response Team (SIRT) disclosed a critical remote command injection vulnerability in Vivotek legacy IP camera firmware tracked as CVE-2026-22755 (reported CVSS 9.3). The flaw enables unauthenticated attackers to execute arbitrary commands as root by abusing the camera’s file upload handling in the upload_map.cgi CGI endpoint, where a user-controlled filename is incorporated into a formatted string and then passed to a shell via system() without proper sanitization, allowing shell metacharacter injection (e.g., ;).

Technical reporting indicates exploitation hinges on crafting an upload that satisfies several implementation constraints (e.g., upload size limits and firmware validation behaviors) and invoking the upload path in a way that preserves required environment variables; researchers demonstrated command execution by embedding commands in the filename and observing uid=0 output. The issue reportedly impacts dozens of models (36 cited) across multiple Vivotek product lines and is amplified by findings that some affected legacy devices may ship or operate without passwords set by default, increasing the likelihood of opportunistic compromise and downstream abuse (e.g., botnet recruitment and DDoS activity) in environments still running legacy surveillance infrastructure.