Critical Vivotek Flaw Grants Root Access (CVE-2026-22755)

A new critical vulnerability has been disclosed in the firmware of Vivotek legacy cameras, potentially turning thousands of surveillance devices into components of botnets. CVE-2026-22755 is described as a remote command injection flaw with a CVSS of 9.3, arising from improper sanitisation of filenames during file uploads.

According to Akamai Security Intelligence and Response Team (SIRT), the flaw allows remote users to inject arbitrary code into the filename supplied to upload_map.cgi, enabling commands to run as the HTTP server’s user ID, which is root. The researchers note that the vulnerability can grant complete administrative control over the camera simply by uploading a file with a malicious name, and in many cases authentication may not be required because the cameras do not appear to have passwords set.

The vulnerability affects a wide range of legacy models, including the FD8365, IB9365 and IP9165 series, making unpatched devices attractive targets for threat actors seeking to expand their botnets. 22 January 2026.