Critical Vivotek Flaw Enables Remote Arbitrary Code Execution
The Akamai Security Intelligence and Response Team (SIRT) has identified a critical command injection vulnerability in legacy Vivotek IoT camera firmware. This vulnerability, cataloged as CVE-2026-22755 , permits remote attackers to inject and execute…
The Akamai Security Intelligence and Response Team (SIRT) has identified a critical command injection vulnerability in legacy Vivotek IoT camera firmware. This vulnerability, cataloged as CVE-2026-22755 , permits remote attackers to inject and execute arbitrary code with root access, bypassing authentication. The discovery of this flaw involved AI-driven reverse engineering and affects multiple older camera models, significantly increasing the risk of botnet activities such as Distributed Denial-of-Service (DDoS) attacks via compromised IoT devices.
The vulnerability arises from improper handling of user input within the upload_map.cgi script. Disassembled code reveals that the snprintf() function constructs a string in the format of "mv %s %s" using attacker-supplied filenames, which is then executed by the system() call. Crafted filenames like "test_firmware.bin;id;" can be used to execute shell commands.
Exploitation requires five conditions to be met:
The file size must be under 5MB. Firmware checks must pass with specific magic bytes at the beginning and end. The /usr/sbin/confclient must return "capability_remotecamctrl_master=1". A customized Boa web server must be used with nonstandard environment variables. The call must be made via upload_map.cgi , not file_manager.cgi .
For demonstration, researchers emulated the ARM environment and created dummy firmware using a Bash script:
The Akamai Security Intelligence and Response Team (SIRT) has identified a critical command injection vulnerability in legacy Vivotek IoT camera firmware.
#!/bin/bash TEMP_DIR=/tmp FIRMWARE_FILE="$TEMP_DIR/firmware.bin" printf '\xFF\x56\xFF\xFF' > "$FIRMWARE_FILE" dd if=/dev/zero bs=1 count=1000 >> "$FIRMWARE_FILE" 2>/dev/null printf '\xFF\x4B\xFF\xFF' >> "$FIRMWARE_FILE"
Environment variables were set for the script execution, including REQUEST_METHOD=POST , CONTENT_LENGTH=55123 , and QUERY_STRING=camid=1 . Executing /usr/share/www/cgi-bin/upload_map.cgi outputs root user details, confirming the execution of the id command due to shell parsing.
Affected Models and Indicators of Compromise (IOCs)
Multiple Vivotek models with certain firmware versions are vulnerable and require immediate updates. Key indicators of compromise include:
Path: /cgi-bin/admin/upload_map.cgi Parameter: camid= Environment Variable: POST_FILE_NAME containing ; (e.g., test_firmware.bin;id; ) Magic Bytes: Header: \xFF\x56\xFF\xFF ; Footer: \xFF\x4B\xFF\xFF YARA Rule: rule CVE_2026_22755_Vivotek_upload { strings: $path = "/cgi-bin/admin/upload_map.cgi"; $param = "camid="; condition: all of them }
Vendors are advised to release patches promptly, and users should update their firmware without delay. Security measures include sanitizing filenames server-side, restricting uploads, and monitoring IOCs using the provided YARA rule. Testing should be conducted in controlled environments to evaluate potential exploits.
This vulnerability highlights the security risks associated with legacy IoT devices. The potential for complete system compromise, data theft, or incorporation into DDoS attacks is significant. Users are encouraged to segment networks and disable unused CGI endpoints, while security teams should actively monitor for unusual upload activities.
For further details, please refer to Akamai's announcement .
Based on reporting by GBHackers.