We handle all your technical problems so you can focus on growing your business.
Two bullet-style security cameras mounted on a gray concrete wall, wired to a small junction box.
CybersecurityPractical insight for your business.

CISA Warns of a Critical Flaw in 37 VIVOTEK Security Camera Models

CISA says a flaw in VIVOTEK camera firmware could let an attacker take over the camera, and a public demonstration exists. VIVOTEK has fixed firmware. Ask your installer to update it and keep the cameras off the internet.

Kevin R.

3 min read

Photo by Scott Webb on Unsplash

The takeaway

If you have VIVOTEK cameras, ask your installer to put the latest firmware on every one and confirm that neither the cameras nor the recorder can be reached directly from the internet.

On Tuesday, September 29, 2026, CISA published advisory ICSA-26-272-03 about a flaw in the firmware of 37 VIVOTEK security camera models. CISA rates it 10 out of 10, the highest possible severity score, and says exploitation could let an attacker run commands on the camera, “potentially with root privileges, leading to full compromise of the camera system.”

VIVOTEK has fixed firmware available, according to CISA.

What CISA says

  • The flaw: CVE-2026-22755, a command-injection flaw, meaning an attacker can slip their own commands into the camera’s software.
  • Affected models: 37 VIVOTEK models across the FD, FE, IB, IP, IT, MA, MS and TB series. The full list is in the advisory.
  • A public demonstration exists. CISA says it found a public proof of concept, a working demonstration of the attack that anyone can read, and reported it to VIVOTEK.
  • No reported attacks yet. CISA says no known public exploitation specifically targeting this flaw has been reported to it.
  • A fix is out. According to CISA, VIVOTEK “has addressed this issue and encourages users to download and install the latest firmware available.”

The flaw was first listed in the National Vulnerability Database on January 13, 2026. CISA’s advisory is what brought it wider attention.

Who is affected

Businesses with VIVOTEK cameras, which are often installed by a security or low-voltage integrator. The model number is printed on the camera and usually appears in the recorder’s camera list.

A camera that can be reached from the internet is the biggest concern, because a public demonstration makes the attack easier to repeat.

What to do

Ask your installer three things:

  1. Put the latest VIVOTEK firmware on every camera, and confirm the version afterward.
  2. Confirm that neither the cameras nor the recorder can be reached directly from the internet. That rules out port forwarding on your router for the cameras. CISA recommends keeping such devices off the internet and using a VPN (a secure, encrypted connection into your network) when remote viewing is needed.
  3. If a model has no newer firmware, keep it off the internet and talk about replacing it.

If you’d like help finding out which devices on your network can be reached from the internet, NightSquawk Tech offers a free assessment.

Sources

Editorial note: This article was drafted with AI assistance from CISA’s advisory and the National Vulnerability Database entry, linked above. NightSquawk Tech did not test this vulnerability. We do not link to proof-of-concept code. Details are as published on October 9, 2026.