VIVOTEK Camera Firmware: 1 CVE, Critical 10.0
Summary
CISA reports 1 vulnerability in VIVOTEK V Series, C Series, S Series, Dome and 3 more. Weakness type: Improper Neutralization of Special Elements used in a Command ('Command Injection'). Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentially with root privileges, leading to full compromise of the camera system. Highest CVSS v3 score: 10.0 (Critical), exploitable over the network.
At a glance
- Vendor
- VIVOTEK
- Products
- V Series, C Series, S Series, Dome, Panoramic, VIVOTEK Camera, Bullet
- CVEs
- CVE-2026-22755
- Highest CVSS v3
- 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Government Services and Facilities, Transportation Systems, Commercial Facilities, Energy, Critical Manufacturing, Financial Services
- Deployed
- Worldwide
- Vendor HQ
- Taiwan
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-22755 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | 10.0 | – | No | A command injection vulnerability has been identified in firmware modules used by multiple network camera models from VIVOTEK. |
Affected products (37)
- VIVOTEK V Series: model_FD9187
- VIVOTEK V Series: model_FD9189
- VIVOTEK V Series: model_FD9365
- VIVOTEK V Series: model_FD9387
- VIVOTEK V Series: model_FD9389
- VIVOTEK V Series: model_FD9391
- VIVOTEK C Series: model_FE9180
- VIVOTEK V Series: model_FE9191
- VIVOTEK V Series: model_FE9382
- VIVOTEK V Series: model_FE9391
- VIVOTEK V Series: model_IB9365
- VIVOTEK V Series: model_IB9387
- VIVOTEK V Series: model_IB9389
- VIVOTEK V Series: model_IB939
- VIVOTEK V Series: model_IP9165
- VIVOTEK V Series: model_IP9171
- VIVOTEK S Series: model_IP9172
- VIVOTEK V Series: model_IP9181
- VIVOTEK V Series: model_IP9191
- VIVOTEK V Series: model_IT9389
- VIVOTEK V Series: model_MA9321
- VIVOTEK V Series: model_MA9322
- VIVOTEK S Series: model_MS9321
- VIVOTEK V Series: model_MS9390
- VIVOTEK S Series: model_TB9330
- VIVOTEK Dome: model_FD8365
- VIVOTEK Dome: model_FD8365v2
- VIVOTEK Dome: model_FD9165
- VIVOTEK Dome: model_FD9171
- VIVOTEK Dome: model_FD9371
- VIVOTEK Dome: model_FD9381
- VIVOTEK Panoramic: model_FE9181
- VIVOTEK Panoramic: model_FE9381
- VIVOTEK VIVOTEK Camera: model_FE9582
- VIVOTEK VIVOTEK Camera: model_IB93587LPR
- VIVOTEK Bullet: model_IB9371
- VIVOTEK Bullet: model_IB9381
Vendor fixes and mitigations (from advisory)
- Mitigation: VIVOTEK has addressed this issue and encourages users to download and install the latest firmware available.https://www.vivotek.com/en-US/resource/download-center/software-app-vadp-package link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.