CVE-2026-22755: Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330 (Firmware modules) allows OS Command Injection.This issue affects Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330: 0100a, 0106a, 0106b, 0107a, 0107b1, 0109a, 0112a, 0113a, 0113d, 0117b, 0119e, 0120b, 0121, 0121d, 0121d485731, 0122e, 0124d485731, 012501, 012502, 0125c.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22755?
CVE-2026-22755 is considered a high-severity vulnerability due to its exploitation potential through default login credentials.
How do I fix CVE-2026-22755?
To fix CVE-2026-22755, change the default login credentials to strong, unique passwords and ensure device firmware is updated.
What devices are affected by CVE-2026-22755?
CVE-2026-22755 affects several Vivotek camera models including FD8365, FD9165, and FD9391 among others.
What is command injection in CVE-2026-22755?
Command injection in CVE-2026-22755 refers to the improper handling of special characters that can be exploited to execute arbitrary commands on the device.
Is CVE-2026-22755 an unpatched vulnerability?
Yes, CVE-2026-22755 remains unpatched for many legacy Vivotek devices, making users particularly vulnerable.