Critical Vivotek Vulnerability Allows Remote Users to Inject Arbitrary Code

Cybersecuritynews •Abinaya • January 22, 2026

A critical remote code injection vulnerability in Vivotek legacy firmware that enables unauthenticated attackers to execute arbitrary commands with root privileges. The vulnerability, tracked as CVE-2026-22755, affects dozens of camera models and poses significant risks to organizations relying on legacy surveillance infrastructure. The vulnerability exists in the upload_map.cgi script, where user-supplied filenames are processed through an unsanitized snprintf() function […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vivotek Vulnerability Enables Remote Code Execution A critical vulnerability in Vivotek legacy firmware allows unauthenticated attackers to execute arbitrary commands with root privileges. Tracked as CVE-2026-22755, it affects numerous camera models and is particularly concerning for organizations using outdated surveillance systems. The flaw is found in the upload_map.cgi script, which improperly processes user-supplied filenames. 3 sources 48

Extracted Entities

Critical Vivotek Vulnerability Allows Remote Users to Inject Arbitrary Code

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)