VIVOTEK Camera Firmware (CVE-2026-22755)
A critical command injection flaw (CVE-2026-22755, CVSS 10) in VIVOTEK network camera firmware enables unauthenticated remote root execution; a public PoC exists. The vulnerability is a command injection (CWE-77) in firmware modules across 37 VIVOTEK camera models. Exploitation requires no authentication or user interaction and yields root-level remote command execution. A public proof of concept authored by indoushka is available, though no active exploitation has been reported.
Detection / Hunteropenrouter
Immediate Actions
- Update all affected VIVOTEK cameras to latest firmware immediately.
- Block all internet access to camera management interfaces.
- Isolate camera networks from business networks using firewalls.
- Inventory all VIVOTEK cameras and identify affected models.
Key Takeaways
- CVSS v3.1 and v4.0 both score 10.0 (Critical) with no attack complexity.
- 37 camera models across V, C, S, Dome, Panoramic, and Bullet series are affected.
- Public PoC exists; no confirmed active exploitation reported to CISA.
- VIVOTEK has released a firmware update addressing the issue.
- Affected sectors include government, transportation, energy, and financial services.
Attack Chain
- Initial Access: Attacker sends crafted input to VIVOTEK camera firmware module over network
- Execution: Command injection executes attacker commands with root privileges
- Persistence: Root access enables full compromise of camera system
- Impact: Attacker controls camera, may pivot to internal network
Affected Systems
- VIVOTEK V Series cameras (FD9187, FD9189, FD9365, FD9387, FD9389, FD9391, FE9191, FE9382, FE9391, IB9365, IB9387, IB9389, IB939, IP9165, IP9171, IP9181, IP9191, IT9389, MA9321, MA9322, MS9390)
- VIVOTEK C Series cameras (FE9180)
- VIVOTEK S Series cameras (IP9172, MS9321, TB9330)
- VIVOTEK Dome cameras (FD8365, FD8365v2, FD9165, FD9171, FD9371, FD9381)
- VIVOTEK Panoramic cameras (FE9181, FE9381)
- VIVOTEK Bullet cameras (IB9371, IB9381)
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-22755 | VIVOTEK Camera Firmware | Critical | Command injection in firmware modules allows unauthenticated remote root code execution. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Network cameras typically lack EDR agents; endpoint telemetry unavailable. |
| Network Visibility | High | Exploit attempts traverse network to camera web interface; NIDS can detect injection patterns. |
| Detection Difficulty | Moderate | PoC exists but device-specific command injection signatures may need custom rules. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unauthenticated HTTP requests to VIVOTEK camera web interfaces containing shell metacharacters indicate exploitation of CVE-2026-22755 (T1190). | NIDS or reverse proxy logs for camera traffic | Initial Access | Low — shell metacharacters in camera API requests are abnormal |
| Unexpected outbound network connections from VIVOTEK cameras indicate post-exploitation activity (T1059). | Firewall or netflow logs for camera IP addresses | Command and Control | Medium — cameras may legitimately contact NTP or cloud services |
Required Log Sources
- Network firewall logs
- NIDS alerts (Suricata/Zeek)
- Camera access logs
- Web server logs on camera
Key Behavioral Indicators
- HTTP requests to camera with shell metacharacters in parameters
- Unexpected outbound connections from camera IP addresses
- Camera firmware version matching affected model list
Control Gaps
- Network segmentation between camera VLANs and business networks
- Internet-facing exposure of camera management interfaces
- Lack of firmware version inventory for IoT devices
False Positive Assessment
Low — shell metacharacters in HTTP requests to camera firmware modules are abnormal and unlikely in legitimate camera management traffic.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Place camera networks behind firewalls with strict egress filtering.
- Use VPN for remote access to camera management interfaces.
- Implement network segmentation separating camera VLANs from ICS networks.
User Protection
- Monitor camera network traffic for anomalous outbound connections.
- Deploy NIDS rules targeting command injection patterns on camera interfaces.
MITRE ATT&CK Mapping
Initial Access
Execution
Plain-Language Summary
A severe security flaw in VIVOTEK network cameras lets attackers run commands remotely with full control, no password needed. The flaw affects 37 camera models used in government, transportation, and energy facilities worldwide. A proof-of-concept exploit is public. Update camera firmware immediately and ensure devices are not reachable from the internet.
- cveCVE-2026-22755Command injection in firmware modules allows unauthenticated remote root code execution.