VIVOTEK Camera Firmware

CVE-2026-22755

September 29, 2026 · CISA (US-CERT) · Severity: CRITICAL

This CISA advisory reports a command injection vulnerability (CVE-2026-22755) in VIVOTEK camera firmware that can allow remote execution of commands with root privileges. The vulnerability affects a large number of VIVOTEK camera models and poses a risk to critical infrastructure sectors. Users are urged to apply available patches immediately. 📌 **Analyst Note:** Given the CVSS 10.0 score and the targeted critical infrastructure sectors, this vulnerability should be treated as a high priority for patching. Organizations should inventory all VIVOTEK cameras and isolate them if immediate remediation is not possible.

Key Takeaways

A critical command injection vulnerability in VIVOTEK camera firmware allows unauthenticated remote attackers to execute arbitrary commands with root privileges, leading to full device compromise.
The vulnerability affects dozens of VIVOTEK camera models across multiple series, including V Series, S Series, and dome cameras, highlighting widespread exposure.
The affected devices are used in critical infrastructure sectors such as Government Services and Transportation, making successful exploitation a significant threat to national security.