Critical Unpatched Flaw: Vivotek EOL IP Cameras Exposed to Unauthenticated RCE via Command Injection

Akamai's Security Intelligence and Response Team (SIRT) has identified a critical unauthenticated command-injection vulnerability in legacy Vivotek IP cameras, originally noted in 2019 under CVE-2019-19936. This flaw allows attackers to execute arbitrary commands via the /cgi-bin/admin/eventtask.cgi endpoint without authentication, posing a significant security risk as many devices still operate on outdated firmware.

The vulnerability affects numerous Vivotek models, particularly those with firmware versions 0100c to 0305a4, which are no longer supported or patched. Akamai recommends immediate network isolation, disabling public access to camera interfaces, and auditing device fleets to mitigate risks. Although no active exploitation has been reported, the ease of exploitation raises concerns about potential future attacks.