Loading vulnerability…
Unauthenticated Root Command Injection in Vivotek Legacy Camera Firmware
CVE-2026-22755 is an OS command injection vulnerability in firmware for numerous legacy Vivotek surveillance-camera models. The firmware upload handling path incorporates an attacker-controlled filename into a formatted string without adequate sanitization and passes it to a system shell. Shell metacharacters in the filename can therefore cause arbitrary operating-system commands to run. Affected devices include models in the FD, FE, IB, IP, IT, MA, MS, and TB product lines running affected firmware module versions from 0100a through 0125c.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary command execution as root, providing complete administrative control of the affected camera. An attacker could compromise the device, install botnet software, disrupt surveillance operations, exfiltrate data, move laterally within the network, or use compromised devices in distributed-denial-of-service activity.
If you can’t patch tonight, do this now.
Isolate legacy camera infrastructure through network segmentation and restrict access to camera administration interfaces to authorized management hosts. Deploy intrusion-detection signatures where available, and monitor for suspicious firmware-upload activity and anomalous POST requests to camera administrative interfaces.
Patch, then assume compromise.
Prioritize vendor firmware updates for all affected Vivotek models. Maintain a complete inventory of deployed legacy cameras and identify devices running affected firmware module versions. Where an update is unavailable, retire or replace unsupported devices.
No public exploits tracked yet. Mallory keeps watching.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.