VIVOTEK Cameras Vulnerable to Root RCE Flaw
A command injection flaw (CVE-2026-22755) affects dozens of VIVOTEK network camera models, allowing remote command execution with root privileges; a public PoC exists but no in-the-wild exploitation reported.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an ICS advisory for a command injection vulnerability (CVE-2026-22755, CWE-77) impacting firmware across more than 35 VIVOTEK network camera models spanning the V, C, S, Dome, Panoramic, and Bullet series. Successful exploitation could allow an attacker to achieve remote command execution, potentially with root privileges, resulting in full compromise of the affected camera. VIVOTEK is a Taiwan-headquartered manufacturer with devices deployed worldwide across critical infrastructure sectors including government facilities, transportation, commercial facilities, energy, critical manufacturing, and financial services.
CISA discovered a public proof-of-concept for this vulnerability, authored by a researcher known as 'indoushka', and reported it to VIVOTEK. As of the advisory's release, no known public exploitation specifically targeting this vulnerability has been reported to CISA. VIVOTEK has released updated firmware addressing the issue and recommends all users update to the latest available version via its official download center.
Defenders operating any of the listed VIVOTEK camera models should prioritize firmware updates and, in the interim, apply standard ICS network hardening: minimize internet exposure of camera management interfaces, place devices behind firewalls and segment them from business networks, and use VPNs with up-to-date patching for any required remote access. Given the existence of a public PoC and the potential for root-level compromise, organizations should treat unpatched exposed devices as a priority remediation item despite the absence of confirmed active exploitation.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-03
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs