Critical severity · published Jan 13, 2026
CVE-2026-22755
Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi
9.3
CVSS
13.8%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330 (Firmware modules) allows OS Command Injection.This issue affects Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330: 0100a, 0106a, 0106b, 0107a, 0107b_1, 0109a, 0112a, 0113a, 0113d, 0117b, 0119e, 0120b, 0121, 0121d, 0121d_48573_1, 0122e, 0124d_48573_1, 012501, 012502, 0125c.
Exploitation
Is it being used?
Exploit prediction (EPSS)13.8% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA · Vivotek
0100a; 0106a; 0106b; 0107a; 0107b_1; 0109a; +14 more · source: vendor
In the news
VulnerabilityHigh
VIVOTEK Camera Firmware
View CSAF
Summary
Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentially with root privileges, leading to full compromise of the camera system.
The following versions of VIVOTEK Camera Firmware are affected:
V Series model_FD9187 (CVE-2026-22755)
V Series model_FD9189 (CVE-2026-22755)
V Series model_FD9365 (CVE-2026-22755)
V Series model_FD9387 (CVE-2026-22755)
V Series model_FD9389 (CVE-2026-22755)
V Series model_FD9391 (CVE-2026-22755)
C Series model_FE9180 (CVE-2026-22755)
V Series model_FE9191 (CVE-2026-22755)
V Series model_FE9382 (CVE-2026-22755)
V Series model_FE9391 (CVE-2026-22755)
V Series model_IB9365 (CVE-2026-22755)
V Series model_IB9387 (CVE-2026-22755)
V Series model_IB9389 (CVE-2026-22755)
V Series model_IB939 (CVE-2026-22755)
V Series model_IP9165 (CVE-2026-22755)
V Series model_IP9171 (CVE-2026-22755)
S Series model_IP9172 (CVE-2026-22755)
V Series model_IP9181 (CVE-2026-22755)
V Series model_IP9191 (CVE-2026-22755)
V Series model_IT9389 (CVE-2026-22755)
V Series model_MA9321 (CVE-2026-22755)
V Series model_MA9322 (CVE-2026-22755)
S Series model_MS9321 (CVE-2026-22755)
V Series model_MS9390 (CVE-2026-22755)
S Series model_TB9330 (CVE-2026-22755)
Dome model_FD8365 (CVE-2026-22755)
Dome model_FD8365v2 (CVE-2026-22755)
Dome model_FD9165 (CVE-2026-22755)
Dome model_FD9171 (CVE-2026-22755)
Dome model_FD9371 (CVE-2...
Sep 29, 2026·CISA Advisories
Affected product
AD
Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA
Vivotek