Critical Remote Code Execution Flaw in Vivotek Legacy Cameras Exposes Networks to Root-Level Attacks Akamai researchers have uncovered a severe remote code execution (RCE) vulnerability in Vivotek’s legacy firmware, tracked as CVE-2026-22755, which allows unauthenticated attackers to execute arbitrary commands with root privileges on affected surveillance cameras. The flaw resides in the upload_map.cgi script, where unsanitized user-supplied filenames are passed to a `system()` call via an insecure `snprintf()` function. By embedding shell metacharacters (e.g., semicolons) in filenames, attackers can inject malicious commands. Exploitation requires five conditions: a file under 5MB, a firmware verification bypass, an intact `/usr/sbin/confclient` binary, non-standard web server environment variables, and access via upload_map.cgi (not file_manager.cgi). A proof-of-concept (PoC) demonstrated that setting an environment variable like `POST_FILE_NAME="test_firmware.bin; id;"` triggers command execution as root (UID 0). Researchers bypassed firmware validation by crafting files with specific magic bytes (`FF V FF FF` header and `FF K FF FF` footer). Affected Models & Firmware The vulnerability impacts 36 camera models across multiple Vivotek product lines, including: - FD8365, FD9165, FD9371 (firmware versions 0100a–0125c) - FE9180, FE9191 (0100a–0125c) - IB9365, IP9165, IP9171 (0100a–0125c) - MA9321, MS9390, TB9330 (0100a–0125c) Attack Scenario & Impact An attacker can remotely upload a malicious firmware file with an embedded command in the filename. When processed by the vulnerable script, the payload executes with root privileges, enabling full system compromise, lateral movement, botnet recruitment, or data exfiltration. The flaw poses a critical IoT security risk, particularly for organizations in critical infrastructure, healthcare, and enterprise environments relying on legacy surveillance systems. Akamai has released a YARA rule to detect exploitation attempts targeting upload_map.cgi with the `camid` parameter. The vulnerability underscores the dangers of unauthenticated RCE in IoT devices, which can serve as entry points for broader network attacks, including DDoS botnets.