The vulnerability arises from improper handling of user-supplied input in the upload_map.cgi module of certain Vivotek firmware versions, enabling an attacker to inject and execute arbitrary operating‑system commands. An attacker who can reach the web interface of a vulnerable device could thus gain full control over the device’s operating system, leading to complete compromise of the camera and potentially any network resources the device is connected to. The weakness is described as Command Injection (CWE‑77).

The affected devices are Vivotek cameras with the following model numbers: FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391, FE9180, FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371, IB9381, IB9387, IB9389, IB939, IP9165, IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330.

The CVSS score of 9.3 indicates a critical severity. The EPSS score of less than 1% suggests that exploitation attempts have been rare to date, yet the vulnerability persists in firmware up to version 0125c. It is not listed in the CISA KEV catalog. Based on the description, the flaw is likely exploitable via the web interface’s upload_map.cgi endpoint; authentication requirements are not explicitly stated, so any user with access to the device’s management interface could potentially leverage the injection unless network segmentation or access control limits exposure.