noindex and left out of the sitemap until more data is confirmed.CVE-2026-22755 is a critical, unauthenticated command-injection vulnerability in the upload_map.cgi script of VIVOTEK camera firmware that lets an attacker run arbitrary commands as root via a crafted filename, across 36 camera models, but NVD's vulnerability status for this CVE is "Deferred" with no NVD-published Primary score and it is not listed on CISA's KEV catalog, so per our indexing policy this page stays pending with no NVD-confirmed cvss_score.
Vulnerability summary
N/A
Not yet scored
13.8%
EPSS score (FIRST)
No
CISA KEV catalog
2026-01-13
Published
Vulnerability ID: CVE-2026-22755 · Source: NVD (independent researcher Secondary score only, not NVD Primary; vulnStatus: Deferred)
Affected components
| Component | CPE | Version range |
|---|---|---|
| VIVOTEK Camera Firmware (V, C, S, Dome, Panoramic and Bullet series — 36 models including FD8365, FD9165, FD9389, FE9180, FE9582, IB9365, IB93587LPR, IP9165, IP9172, IT9389, MA9321, MS9321, MS9390, TB9330) | — | firmware 0100a through 0125c (per Akamai); no NVD-listed configurations, and no confirmed fixed firmware version published by the vendor as of this review |
What this means
CVE-2026-22755 is a CWE-77 (Improper Neutralization of Special Elements used in a Command / OS Command Injection) vulnerability in VIVOTEK IP camera firmware. Akamai's Security Intelligence and Response Team (SIRT), which discovered the flaw using AI-assisted reverse engineering of VIVOTEK firmware images, describes it precisely: the upload_map.cgi script fails to sanitize filenames before passing them to a shell command, so an unauthenticated attacker can embed OS commands inside a crafted filename and have them executed as root on the camera. Akamai's writeup lists the affected firmware range as versions 0100a through 0125c and names 34 of the affected models (including FD8365, FD9165, FE9180, IB9365, IP9171, MA9321, MS9390 and TB9330); CISA's own ICS advisory lists a slightly broader set of 36 models across VIVOTEK's V, C, S, Dome, Panoramic and Bullet product lines (Akamai SIRT: Command Injection in VIVOTEK Legacy Firmware; CISA ICS Advisory ICSA-26-272-03).
NVD lists this CVE with vulnStatus: Deferred — NVD has not performed its own independent analysis or published a Primary CVSS score, two and a half years after this CVE ID was first published (2026-01-13). The only metric NVD records is a Secondary CVSS v4.0 score of 9.3 (critical) attributed to the reporting researcher (Larry Cashdollar, via his personal CNA identifier), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; this is a researcher-submitted figure, not an NVD-confirmed one, so it is not used as this page's cvss_score (NVD).
CISA's ICS advisory independently computed its own CVSS figures rather than deferring to NVD, rating the flaw CVSS v3.1 10.0 (critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0 10.0 (critical) — the maximum possible score on both scales — and credits reporter "indoushka" alongside the Akamai SIRT disclosure. CISA's advisory states plainly that successful exploitation "may allow attackers to achieve remote command execution on affected devices, potentially with root privileges, leading to full compromise," and that VIVOTEK's own remediation guidance is only to "download and install the latest firmware available" from its download center, without a specific fixed-version number being published in the advisory (CISA ICS Advisory ICSA-26-272-03).
Akamai's post includes working proof-of-concept exploitation code and a YARA detection rule for requests to /cgi-bin/admin/upload_map.cgi carrying a camid= parameter, and recommends that vendors "promptly release firmware patches" and that operators restrict network exposure of these devices in the meantime (Akamai SIRT: Command Injection in VIVOTEK Legacy Firmware).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.13806 (96.509th percentile) — notably high for a CVE that is neither NVD-Analyzed nor present on the CISA KEV catalog, plausibly reflecting the public proof-of-concept code and YARA rule Akamai has already published. The CVE is confirmed absent from the live KEV feed by exact cveID match this run (FIRST EPSS; CISA KEV catalog).
Until NVD completes its own analysis, treat the 9.3-10.0 range figures above as indicative only, not NVD-confirmed. Given the public exploit code, operators of any of the listed VIVOTEK models should take them off the open internet, isolate them behind a firewall or VPN, and install the latest available firmware from VIVOTEK's download center immediately.
Evidence
- The upload_map.cgi script in VIVOTEK camera firmware fails to sanitize filenames, letting an unauthenticated attacker embed and execute OS commands as root; affects firmware 0100a-0125c across dozens of camera models. — Akamai SIRT: Command Injection in VIVOTEK Legacy Firmware
- NVD's vulnStatus for this CVE is Deferred, with no NVD-published Primary score; the only metric on record is a researcher-submitted CVSS v4.0 score of 9.3, not NVD's own analysis. — NVD
- CISA's ICS advisory independently rates the flaw CVSS v3.1 10.0 and v4.0 10.0, lists 36 affected VIVOTEK models, credits reporter indoushka, and states VIVOTEK's guidance is to install the latest firmware with no specific fixed version named. — CISA ICS Advisory ICSA-26-272-03
- EPSS score is 0.13806 (96.509th percentile) as of 2026-10-29; the CVE is confirmed absent from the live CISA KEV catalog by exact cveID match this run. — FIRST EPSS
