CVE-2026-22755: VIVOTEK Camera Firmware RCE — Defensive Guide for FD/FE/IB Series Exposure

---
title: VIVOTEK Camera Web Service Spawning Shell or Downloader
id: 8d5f4f2a-7a7b-4d62-9c65-202602275501
status: experimental
description: Detects embedded Linux process execution consistent with exploitation of a camera web/CGI service leading to shell, downloader, or post-exploitation tooling. Forward camera syslog or sensor Linux audit data where available.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-03
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/02/13
tags:
  - attack.execution
  - attack.t1059.004
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/lighttpd'
      - '/nginx'
      - '/boa'
      - '/goahead'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/busybox'
      - '/wget'
      - '/curl'
      - '/nc'
      - '/netcat'
      - '/chmod'
      - '/killall'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor firmware scripts during legitimate updates
  - Camera health checks; baseline parent/child pairs before broad deployment
level: high
---
title: Suspicious Command Line in Embedded Camera Syslog
id: 41a6d5fb-3a4e-4e50-9e62-202602275502
status: experimental
description: Flags shell metacharacters or download-and-execute patterns appearing in camera process or web logs forwarded via syslog. Intended for high-value network zones rather than broad enterprise Linux fleets.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-03
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/13
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    CommandLine|contains:
      - 'wget http'
      - 'curl http'
      - '| sh'
      - '|sh'
      - ';id'
      - '; id'
      - 'chmod +x'
      - '/tmp/'
      - '/var/tmp/'
  filter_legit_update:
    CommandLine|contains:
      - 'ntpdate'
      - 'udhcpc'
      - 'crond'
  condition: selection_img and not filter_legit_update
falsepositives:
  - Firmware upgrade jobs if update paths use /tmp
  - Managed service scripts; scope to camera subnets in the SIEM
level: high

let CameraSubnets = dynamic(["10.40.0.0/16", "192.168.50.0/24"]);
let ApprovedDest = dynamic(["10.0.0.5", "10.0.0.6", "10.20.10.15"]);
let CameraIPs = toscalar(print iprange=CameraSubnets | mv-expand iprange to typeof(string));
union isfuzzy=true
(DeviceNetworkEvents
 | where TimeGenerated > ago(7d)
 | where ipv4_is_in_range(LocalIP, "10.40.0.0/16") or ipv4_is_in_range(LocalIP, "192.168.50.0/24")
 | where ActionType == "ConnectionSuccess"
 | where RemoteIP !in (ApprovedDest) and not(ipv4_is_private(RemoteIP))
 | project TimeGenerated, DeviceName, LocalIP, LocalPort, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine),
(CommonSecurityLog
 | where TimeGenerated > ago(7d)
 | where ipv4_is_in_range(SourceIP, "10.40.0.0/16") or ipv4_is_in_range(SourceIP, "192.168.50.0/24")
 | where DestinationIP !in (ApprovedDest) and not(ipv4_is_private(DestinationIP))
 | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, SourcePort, DestinationIP, DestinationPort, Protocol, Message)
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Samples=make_set(Message, 5) by SourceIP=column_ifexists("SourceIP", LocalIP), DestinationIP, DestinationPort
| order by Connections desc;

// Hunt inbound HTTP attempts to camera management interfaces with shell metacharacters in URI or payload. Requires firewall/proxy/Zeek/web logs in Sentinel.
let BadTokens = dynamic([";", "`", "$(", "| sh", "wget", "curl", "chmod", "/tmp/", "busybox"]);
union isfuzzy=true
(CommonSecurityLog
 | where TimeGenerated > ago(14d)
 | where DestinationPort in (80, 443, 554, 8000, 8080)
 | where Message has_any (BadTokens)
 | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL=extract(@"(?i)(GET|POST) ([^ ]+)", 2, Message), Message),
(Syslog
 | where TimeGenerated > ago(14d)
 | where SyslogMessage has_any (BadTokens)
 | where SyslogMessage has_any ("httpd", "cgi", "boa", "goahead", "lighttpd", "rtsp", "vivotek")
 | project TimeGenerated, HostIP, Computer, Facility, SeverityLevel, SyslogMessage)
| order by TimeGenerated desc;

-- Hunt management hosts for tools/sessions touching VIVOTEK camera services after the advisory window.
-- Scope CameraSubnet to your physical security range before scheduling.
LET CameraSubnet = "10.40.0.0/16"
SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime, Exe
FROM pslist()
WHERE CommandLine =~ "(nmap|masscan|curl|wget|nc|netcat|telnet|ssh|rtsp|onvif)"
  AND CommandLine =~ "(10\\.40\\.|192\\.168\\.50\\.|FD9187|FD9387|FE9191|IB9387|vivotek)"

-- Check servers and jump hosts for established connections to camera web/RTSP services.
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status =~ "ESTABLISHED"
  AND RemotePort in (80, 443, 554, 8000, 8080)
  AND RemoteAddr =~ "^(10\\.40\\.|192\\.168\\.50\\.)"

#!/usr/bin/env bash
# VIVOTEK CVE-2026-22755 exposure triage for Linux utility hosts / NVR jump boxes.
set -euo pipefail
CAM_NETS="10.40.0.0/16 192.168.50.0/24"
OUT="vivotek_triage_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUT"

# 1) Discover live camera services without aggressive service probes.
for net in $CAM_NETS; do
  nmap -Pn -p80,443,554,8000,8080 --open -oG "$OUT/nmap_$(echo "$net" | tr '/.' '__').gnmap" "$net" >/dev/null 2>&1 || true
done

# 2) Pull headers/banners only. Do not attempt exploitation.
awk '/Ports:/{print $2}' "$OUT"/*.gnmap | sort -u > "$OUT/live_hosts.txt"
while read -r ip; do
  [ -z "$ip" ] && continue
  curl -k -sS --max-time 4 -I "http://$ip/" | sed -n '1,12p' > "$OUT/http_$ip.txt" 2>&1 || true
  curl -k -sS --max-time 4 -I "https://$ip/" | sed -n '1,12p' > "$OUT/https_$ip.txt" 2>&1 || true
done < "$OUT/live_hosts.txt"

# 3) Flag outbound camera connections on the local firewall/NAT logs if present.
for net in $CAM_NETS; do
  base="$(echo "$net" | cut -d/ -f1 | cut -d. -f1-3)"
  grep -E "$base" /var/log/syslog /var/log/messages 2>/dev/null | grep -Ei 'DST=|dpt=(80|443|554|8000|8080)|NEW|ESTABLISHED' | tail -n 200 > "$OUT/fw_${base}.log" || true
done

# 4) Produce review list.
{
  echo "Live hosts:"; cat "$OUT/live_hosts.txt"
  echo; echo "Potential VIVOTEK banners:"; grep -Eil 'vivotek|network camera|fd918|fe918|fe919|ib936|ib938' "$OUT"/http_*.txt "$OUT"/https_*.txt 2>/dev/null || true
} > "$OUT/review.txt"

echo "Wrote $OUT/review.txt. Patch only via VIVOTEK CSAF fixed firmware; do not run exploit checks against production cameras."