Severe Command Execution Flaw Affects VIVOTEK Camera Firmware

Security Implications for Surveillance Systems

A critical security vulnerability (CVE-2026-22755) has been identified in several VIVOTEK camera models, including the FD9187, FD9189, FD9365, FD9387, and FD9389 series. This flaw permits attackers to achieve remote command execution, potentially with root privileges. Such unauthorized access grants an attacker complete control over the device, which could lead to surveillance footage theft, manipulation, or the integration of the camera into a botnet.

Protective Measures

• Firmware Updates: It is imperative to identify your specific device model and apply the latest firmware updates from the official VIVOTEK support portal.
• Isolate IoT Devices: Avoid exposing surveillance cameras directly to the internet. Deploy them on an isolated network segment (VLAN) without outbound access to sensitive internal business systems.
• Credential Management: Change default login credentials immediately. Use strong, unique passwords for every device to prevent brute-force attacks from escalating the impact of this vulnerability.
• Access Control: Implement firewall rules to permit traffic only from authorized security monitoring stations, blocking all other attempts to interface with the camera’s management console.

---

แหล่งที่มา: CISA Cybersecurity Advisories เผยแพร่ครั้งแรก: Tue, 29 Sep 26 12:00:00 +0000 บทความต้นฉบับ: อ่านต้นฉบับ