OTPulse

VIVOTEK Camera Firmware

Act NowCVSS 10ICS-CERT ICSA-26-272-03Sep 29, 2026
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

VIVOTEK camera firmware contains a command injection vulnerability (CWE-77) that allows an attacker with network access to execute arbitrary commands with root privileges on affected devices. Successful exploitation results in full compromise of the camera system. The vulnerability affects 37 VIVOTEK camera models across multiple series including V Series, C Series, S Series, Dome, Panoramic, and Bullet cameras. VIVOTEK has released firmware updates to address this issue and users are encouraged to download and install the latest firmware.

What this means
What could happen
An attacker could execute arbitrary commands with root privileges on VIVOTEK cameras, gaining complete control over the device. This could disrupt surveillance coverage at critical infrastructure sites like water treatment plants, electrical substations, or perimeter security areas.
Who's at risk
Water utilities, electric utilities, and other critical infrastructure operators who deploy VIVOTEK surveillance cameras for perimeter security, substation monitoring, or physical security should prioritize this update. The vulnerability affects 37 camera models across multiple VIVOTEK product lines (V, C, S, Dome, Panoramic, Bullet series).
How it could be exploited
An attacker with network access to a VIVOTEK camera (no authentication required) can send a specially crafted request to trigger a command injection vulnerability. The attacker can then execute arbitrary commands on the camera with root-level privileges, allowing them to modify system files, disable logging, alter video feeds, or pivot into the wider network.
Prerequisites
  • Network connectivity to the affected VIVOTEK camera on its management or web interface port
  • Camera must be running vulnerable firmware (versions prior to latest available)
Remotely exploitableNo authentication requiredLow complexity attackCVSS 10.0 (critical)High EPSS score (20.4%)Root-level command execution
Exploitability
Likely to be exploited — EPSS score 20.2%
Affected products (37)
37 pending
ProductAffected VersionsFix Status
V Series: model_FD9187model FD9187No fix yet
V Series: model_FD9189model FD9189No fix yet
V Series: model_FD9365model FD9365No fix yet
V Series: model_FD9387model FD9387No fix yet
V Series: model_FD9389model FD9389No fix yet
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict network access to camera management interfaces using firewall rules to allow only authorized monitoring/management stations
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXDownload and install the latest firmware from VIVOTEK's download center for all affected camera models listed in the advisory
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate cameras on a dedicated VLAN separate from OT control systems and critical infrastructure networks
View full CISA ICS-CERT advisory
API: /api/v1/advisories/dbfe9d5c-8bc6-4750-a2ee-343a264be6ab

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.