1. Executive summary
CISA published ICSA-26-272-03 on 29 September 2026 covering CVE-2026-22755, a command injection flaw in VIVOTEK camera firmware modules affecting 37 named camera models across the V, S, C, Dome, Bullet and Panoramic lines. The vulnerability carries a CVSS v3.1 base score of 10.0 (CRITICAL, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and a CVSS v4.0 base score of 10.0 (CRITICAL, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H); successful exploitation allows remote command execution with root privileges and full compromise of the device. CISA states it discovered a public proof of concept authored by indoushka and reported it to VIVOTEK, and that no known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. For EMEA financial services the exposure is physical-security camera estates: branch, ATM lobby, data-centre and corporate-site surveillance hardware that sits on the corporate network and is frequently reachable from it. A root-level compromise of a camera is a network foothold inside the perimeter, not a CCTV problem.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk, general principles | Affected devices are procured from a single ICT third-party provider (VIVOTEK) and remediation depends entirely on that vendor shipping and publishing updated firmware | Firms must be able to evidence that contractual and risk-management arrangements with the camera vendor cover vulnerability notification and patch delivery, and that the estate inventory identifies which sites run affected models |
| DORA Art. 30: key contractual provisions with ICT third-party providers | The only remediation path offered is a vendor firmware download from the VIVOTEK download centre; there is no compensating control the client can apply unilaterally to the firmware itself | Where cameras are in scope of an ICT third-party contract, the contract needs to support the firm obtaining firmware, notification of flaws, and cooperation on remediation timelines |
| NIS2 Art. 21(2)(d): supply chain security measures | The flaw is in firmware supplied by an upstream vendor and inherited by every entity that deployed the affected models | Entities in scope must treat camera firmware as a supply chain security item: know the vendor, know the version, and have a route to remediate |
No DORA incident-reporting article is engaged on the facts available: CISA records no known public exploitation of CVE-2026-22755, so there is no incident to classify or report. That changes if a client observes exploitation in its own estate.
3. Technical analysis & attack chain
CISA's advisory is short. It names the vulnerability class, the affected models, the CVSS scores and the vendor fix, and it does not publish the vulnerable endpoint, parameter, or the firmware module that contains the flaw. The attack chain below is therefore limited to what the advisory supports; steps that would normally be filled in from a technical write-up are marked as not disclosed rather than inferred.
Confirmed steps:
- The attacker reaches the affected camera over the network. The CVSS v3.1 vector is AV:N/PR:N/UI:N, so no authentication and no user interaction are required, and the attack is network-reachable.
- The attacker supplies input containing shell metacharacters to a firmware module that passes it to a command interpreter without neutralisation. CWE-77, Improper Neutralization of Special Elements used in a Command ('Command Injection').
- The injected command executes on the device. CISA states exploitation can achieve remote command execution potentially with root privileges, leading to full compromise of the camera system.
- Scope is marked changed (S:C in the v3.1 vector, and SC:H/SI:H/SA:H in the v4.0 vector), so the impact is assessed as extending beyond the vulnerable component to the surrounding system.
Not disclosed by the source: the listening service, port, URI or parameter that carries the injection; the firmware module or binary involved; whether the injection point is pre- or post-authentication at the protocol level despite the PR:N rating; and whether any default credential or management interface is a prerequisite. Do not assume a specific endpoint. Treat any network-reachable management or API surface on these models as suspect until VIVOTEK's firmware notes say otherwise.
Two points on the scoring. The advisory's summary table lists the flaw at "v3 10", which matches the detailed CVSS v3.1 entry of 10.0 CRITICAL; the v4.0 entry is also 10.0 CRITICAL. Both are reproduced above as published. Separately, CISA records that it discovered a public proof of concept authored by indoushka and reported it to VIVOTEK. That is a single-sourced statement from the advisory itself, and it establishes that exploit code exists publicly; it does not establish that anyone has used it against a financial services estate. CISA's own line is that no known public exploitation specifically targeting this vulnerability has been reported to it at this time. Those two facts sit together: public PoC, no reported in-the-wild targeting.
The related advisories in the corpus (Siemens Siveillance Video, ICSA-26-225-09 and ICSA-26-225-10, and Siemens SINEC INS, ICSA-26-174-04) are separate vendor issues and are not part of this item. They are relevant only as a reminder that video management and physical-security software is a recurring source of command injection and path traversal findings, and that the camera is one component of a chain that includes the VMS server behind it.
4. Mitigation & containment
P1, within 24 hours:
- Inventory the estate against the 37 affected models. The full list is in §5. If the inventory cannot be produced from a CMDB, sweep the camera VLANs and match model strings from the device web interface or ONVIF device information responses.
- For any affected camera reachable from the internet or from a general user VLAN, remove that reachability now. Cameras belong on a dedicated VLAN with no route to user or server segments, and no inbound path from the internet.
- Apply the vendor fix: download and install the latest firmware from the VIVOTEK download centre at hxxps://www[.]vivotek[.]com/en-US/resource/download-center/software-app-vadp-package. CISA states VIVOTEK has addressed the issue. Confirm the installed version after flashing; do not assume a successful upload equals a successful boot of the new image.
- Where a camera cannot be patched immediately, block management and API access to it at the VLAN boundary and disable any remote-access or cloud-relay feature that is not operationally required.
P2, within 72 hours:
- Complete firmware remediation across the remaining affected models, including cameras at branch, ATM and third-party-hosted sites that are not on the corporate network. These are the ones that get missed.
- Check the VMS and NVR layer that these cameras report to. A camera with root-level command execution is a host on the recording network; confirm the VMS is patched to its current release and that camera-to-VMS credentials are not shared across sites.
- Rotate credentials used by cameras for VMS registration, ONVIF, and any cloud or P2P service, on the assumption that a compromised camera exposes them.
P3, within 7 days:
- Add camera firmware version to the asset register as a tracked field, and put the VIVOTEK download centre on the patch-monitoring list so the next firmware release is picked up without waiting for a CISA advisory.
- Review contracts with the camera vendor or the integrator that supplies them against DORA Art. 30 expectations: notification of vulnerabilities, availability of firmware, and a defined remediation window.
- Confirm logging from the camera VLAN reaches the SIEM. Many camera estates are unlogged, which means an exploitation attempt leaves no trace the firm can find after the fact.
5. Indicators of compromise
No atomic indicators of compromise are available in the source material. CISA published no hashes, IP addresses, domains, file paths or command strings for CVE-2026-22755, and none are invented here.
The source does provide the affected model list, which is the actionable artefact for this item. It is reproduced as a table because it is the thing an analyst will work from.
| type | value | confidence | source |
|---|---|---|---|
| affected model | VIVOTEK V Series model_FD9187 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_FD9189 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_FD9365 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_FD9387 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_FD9389 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_FD9391 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK C Series model_FE9180 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_FE9191 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_FE9382 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_FE9391 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_IB9365 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_IB9387 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_IB9389 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_IB939 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_IP9165 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_IP9171 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK S Series model_IP9172 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_IP9181 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_IP9191 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_IT9389 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_MA9321 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_MA9322 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK S Series model_MS9321 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK V Series model_MS9390 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK S Series model_TB9330 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Dome model_FD8365 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Dome model_FD8365v2 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Dome model_FD9165 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Dome model_FD9171 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Dome model_FD9371 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Dome model_FD9381 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Panoramic model_FE9181 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Panoramic model_FE9381 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Camera model_FE9582 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Camera model_IB93587LPR | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Bullet model_IB9371 | high | CISA ICSA-26-272-03 |
| affected model | VIVOTEK Bullet model_IB9381 | high | CISA ICSA-26-272-03 |
affected_model VIVOTEK V Series model_FD9187
affected_model VIVOTEK V Series model_FD9189
affected_model VIVOTEK V Series model_FD9365
affected_model VIVOTEK V Series model_FD9387
affected_model VIVOTEK V Series model_FD9389
affected_model VIVOTEK V Series model_FD9391
affected_model VIVOTEK C Series model_FE9180
affected_model VIVOTEK V Series model_FE9191
affected_model VIVOTEK V Series model_FE9382
affected_model VIVOTEK V Series model_FE9391
affected_model VIVOTEK V Series model_IB9365
affected_model VIVOTEK V Series model_IB9387
affected_model VIVOTEK V Series model_IB9389
affected_model VIVOTEK V Series model_IB939
affected_model VIVOTEK V Series model_IP9165
affected_model VIVOTEK V Series model_IP9171
affected_model VIVOTEK S Series model_IP9172
affected_model VIVOTEK V Series model_IP9181
affected_model VIVOTEK V Series model_IP9191
affected_model VIVOTEK V Series model_IT9389
affected_model VIVOTEK V Series model_MA9321
affected_model VIVOTEK V Series model_MA9322
affected_model VIVOTEK S Series model_MS9321
affected_model VIVOTEK V Series model_MS9390
affected_model VIVOTEK S Series model_TB9330
affected_model VIVOTEK Dome model_FD8365
affected_model VIVOTEK Dome model_FD8365v2
affected_model VIVOTEK Dome model_FD9165
affected_model VIVOTEK Dome model_FD9171
affected_model VIVOTEK Dome model_FD9371
affected_model VIVOTEK Dome model_FD9381
affected_model VIVOTEK Panoramic model_FE9181
affected_model VIVOTEK Panoramic model_FE9381
affected_model VIVOTEK Camera model_FE9582
affected_model VIVOTEK Camera model_IB93587LPR
affected_model VIVOTEK Bullet model_IB9371
affected_model VIVOTEK Bullet model_IB9381
Behavioural indicators:
| behaviour | where to observe | confidence |
|---|---|---|
| Unexpected outbound connections from a camera VLAN to the internet or to non-VMS hosts | Firewall and netflow logs for the camera VLAN | medium; general camera-compromise behaviour, not specific to this CVE |
| Shell or command-interpreter child processes spawned by the camera's web or management service | Host-based telemetry on the camera, if the model supports it; otherwise VMS-side logs | medium; consistent with CWE-77 but not confirmed for this firmware |
| Camera firmware version unchanged after a scheduled update window | Firmware version field in the asset register or device web interface | high; directly checkable |
6. Detection
The source material contains no distinctive strings, command lines, file names, registry keys or network artefacts for CVE-2026-22755. CISA published the vulnerability class and the affected models only. There is nothing to build a YARA rule from that would detect the threat rather than detect reporting about it.
Insufficient indicators to author detection rules.
What can be done without a rule: alert on camera firmware version drift against the asset register, and alert on any camera VLAN host initiating outbound connections outside the VMS and NTP ranges. Both are estate hygiene detections, not CVE-specific ones, and should be labelled as such in the SIEM so they are not mistaken for coverage of this flaw.
7. Sources
- CISA, "VIVOTEK Camera Firmware", ICSA-26-272-03, published 2026-09-29. https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-03
- VIVOTEK, software and VADP package download centre (vendor fix referenced by CISA). https://www.vivotek.com/en-US/resource/download-center/software-app-vadp-package
- CISA, "Siemens Siveillance Video", ICSA-26-225-09 (related context only, separate vendor issue). https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-09
- CISA, "Siemens Siveillance Video", ICSA-26-225-10 (related context only, separate vendor issue). https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-10
- CISA, "Siemens SINEC INS", ICSA-26-174-04 (related context only, separate vendor issue). https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-04
8. Adverse Trace position
Adverse Trace assesses CVE-2026-22755 as a 10.0 CRITICAL network-reachable command injection with a public proof of concept and no reported in-the-wild exploitation, and we are not raising it above that on the basis of the PoC alone. The severity is high because of what a camera is, not because of what has been observed: root on a camera that sits inside the corporate network is a foothold, and camera estates are among the least-patched, least-logged and most internet-exposed assets in a typical EMEA bank. The attribution-relevant claim in the source, that CISA discovered a PoC authored by indoushka, is single-sourced to the advisory and we treat it as unconfirmed beyond that; no MITRE ATT&CK profile is associated with that name in our reference data, and we make no actor attribution. The model list is the operational artefact and it is long: 37 models, spanning current V and S series through older Dome and Bullet units that may still be in service at branch sites. We will track VIVOTEK firmware releases and any change to CISA's exploitation status, and we will re-issue if exploitation is reported. Clients who cannot produce a camera inventory within 24 hours should treat that gap as the finding, because without it the affected-model list cannot be applied to anything.
Published via PulseTrace — Adverse Trace threat intelligence.