CVE-2026-22755

CVE-2026-22755 is an OS command injection flaw (CWE-77, improper neutralization of special elements used in a command) in the firmware of 36 Vivotek network camera models spanning the FD, FE, IB, IP, IT, MA, MS and TB 9-series lines. Per the CVSS 4.0 vector, it is exploitable over the network with no privileges required and no user interaction, meaning an attacker can send crafted input to a network-facing service in the camera firmware and have arbitrary operating-system commands executed on the device. Successful exploitation carries high impact to the camera's confidentiality, integrity and availability - and to subsequent systems - consistent with full device compromise and potential lateral movement into the surrounding surveillance network. Any deployment running one of the listed models on one of the 20 listed firmware module versions (0100a through 0125c) is affected, with directly internet-exposed cameras at greatest risk. No public proof of concept or confirmed in-the-wild exploitation is known (not yet in CISA KEV), but EPSS assigns a 20.7% probability of exploitation within 30 days (97th percentile), making this a high-priority patching target.

What to do: Inventory all Vivotek cameras and compare installed firmware module versions against the affected list (0100a through 0125c on the listed models); upgrade to Vivotek's patched firmware as soon as a fixed release is identified, since the advisory data specifies no fixed version. Until patched, avoid exposing affected cameras' web interfaces directly to the internet - restrict management access to isolated VLANs or VPN - and monitor devices for exploitation attempts, prioritizing internet-facing units given the 20.7% EPSS (97th percentile).