Critical Vivotek Flaw Enables Remote Arbitrary Code Execution

Akamai SIRT disclosed CVE-2026-22755: an unauthenticated command injection in legacy Vivotek camera firmware that lets attackers run arbitrary commands as root by exploiting unsafe filename handling in /cgi-bin/admin/upload_map.cgi. The report provides a working proof-of-concept using crafted firmware and environment variables, lists dozens of affected models and firmware versions, supplies IOCs (endpoint, POST_FILE_NAME pattern with semicolon, firmware magic bytes) and a YARA rule, and urges immediate patching, sanitization of uploads, and network mitigations to prevent botnet recruitment and full device compromise.