CVE-2026-22755 is a remote command injection vulnerability discovered in the firmware of many legacy Vivotek network cameras and related devices. It occurs because unsanitized user input is passed into a shell command, allowing attackers to execute arbitrary operating system commands.

This flaw exists specifically in a CGI script (upload_map.cgi) used for handling uploaded firmware or configuration files. Because the device firmware fails to properly neutralize special characters in user-supplied filenames, an attacker can inject additional commands.

---

Impact

• Unauthenticated & Remote Exploitation: No credentials or prior access required.
• Arbitrary Code Execution: An attacker with network access to the device can execute commands as the system user (often root).
• Full Device Compromise: This can lead to unauthorized access, misuse, data theft, or turning the device into part of a botnet.
• High Impact on Confidentiality, Integrity, and Availability.

---

Affected Devices

Numerous legacy Vivotek models are impacted — primarily network cameras and similar hardware. Examples include (but aren’t limited to):
FD8365, FD9165, FD9171, FD9187, FD9381, FE9180, IB9381, IP9191, MA9321, MS9390, TB9330, etc.

Also affected are many older firmware versions such as:
0100a, 0106a/b, 0107a/b_1, 0109a, 0112a, 0113a/d, 0117b, 0119e, 0120b, 0121/d/_48573_1, 0122e, 0124d/_48573_1, 012501/2, 0125c.

---

How the Exploit Works (Technical Summary)

Attackers can craft a malicious filename with shell metacharacters (e.g., semicolons ;) so that the underlying firmware constructs and executes a command like : mv test_firmware.bin; id; /target/location

Here, the injected id is executed by the system shell, illustrating arbitrary command execution.

Because some legacy firmware has no default password set, no authentication is required to trigger this behavior.

---

Mitigation & Protection

At the moment:

• There’s no widely published patch listed yet for all affected firmware.
• Users should immediately isolate or disable affected devices if they must remain on the network.
• Restrict network access to these devices (e.g., remove from public/external network segments).
• Monitor for suspicious traffic targeting upload_map.cgi or similar firmware upload endpoints.
• If possible, contact Vivotek support or check their official advisories for firmware updates.

---

1. Affected devices are at high risk of remote takeover.
2. This vulnerability is easy to exploit without authentication.
3. Immediate action is recommended if you manage networks with vulnerable Vivotek hardware.