Firmwhere? Rediscovering a Vulnerability in Vivotek Legacy Firmware

• The Akamai Security Intelligence and Response Team (SIRT) has identified an unauthenticated command injection that was previously partially disclosed in 2019. The flaw lies in the /cgi-bin/admin/eventtask.cgi parameter within Vivotek legacy firmware. It was originally assigned CVE-2019-19936, but the details were never published and the CVE remains in RESERVED status. 

• Vivotek has confirmed that the vulnerability impacts legacy hardware that is running old firmware and has said it’s been patched in the latest firmware.

• We conducted a vulnerability test on a Vivotek Dome Camera model FD8154-F2. We purchased the camera and then reset it to manufacturer defaults before testing. The default login is root and the camera has no password set.  

• We have not seen active exploitation of this vulnerability at the time of publication.

• Some firmware models have default passwords of mpeg4soc for the root account and the user account login assigning CVE-ID CVE-2025-12592.

There are two ways that the Akamai Security Intelligence Response Team (SIRT) discovers, examines, and analyzes the threats active in the wild — reactively and proactively. We reverse-engineer samples that target our global network of custom honeypots, and we examine and investigate firmware to understand the underlying vulnerabilities. 

With the cascading effect of patch updates, there can be several zero-days hiding in a firmware’s nooks and crannies. This can be particularly dangerous for Internet of Things (IoT) devices (such as IP cameras), which are notorious for their basic admin credentials — especially if the firmware is retired by the vendor.

Once vendors discontinue updates, these devices become permanent weak points in a network, providing attackers with exploitable entry paths that can bypass modern defenses.

During one of these firmware investigations, I decided to look for new zero-days in publicly available Vivotek firmware since there were several versions available. The firmware I downloaded is for their legacy devices and is no longer supported by the vendor, but it is still widely used across many of their existing device models.

I used a Vivotek Dome Camera model FD8154-F2 for this analysis, reset to manufacturer defaults (Figure 1).

A simple curl command is all that is needed to run arbitrary commands on a vulnerable device. I've redacted the details as the vulnerability will not be patched in unsupported firmware, but I’ve provided the results of executing the uptime command in Figure 3.

By default the camera has no authentication, so a simple curl command to eventtask.cgi that returns “Missing parameter” likely means your device is vulnerable (Figure 4).

A web search for Vivotek eventtask.cgi CVE didn’t yield any results, nor did a search in our attack logs show any previous exploitation attempts. However,  it was brought to my attention that a reference to eventtask.cgi and CVE-ID was made on a Vivotek .pdf document but the details were vague and the CVE remained in a RESERVED state.  It seems this vulnerability was discovered but not documented and published.

There are a significant number of models impacted, many of them quite old and no longer supported by the vendor but still widely used in the wild.

Since the swath of affected devices spans indoor, outdoor, residential, commercial, and beyond, I’ve created a series of tables to assist in identifying the various affected models to assess their vulnerability level.

Table 1 identifies the device type and typical use by prefix.

Table 1: Prefix, type, and typical use of Vivotek devices

Vivotek’s’s numeric series provides a rough idea of the typical resolution and generation (era), as shown in Table 2.

Table 2: Vivotek’s resolution and generation (era) may be indicated by series number

Table 4 identifies the vulnerable Vivotek device models with the default password of mpeg4soc.

Table 4. List of devices with default password of mpeg4soc

Figure 5 shows the YARA rule to match on exploitation attempts.

Legacy IoT devices continue to pose a significant threat to security as they age and stop being  supported by manufacturers. Many of these devices — from cameras and routers to industrial sensors and smart home equipment — were designed with limited security features and often rely on outdated firmware that is no longer maintained or patched against newly discovered vulnerabilities.

Once vendors discontinue updates, these devices become permanent weak points in a network, providing attackers with exploitable entry paths that can bypass modern defenses. Legacy IoT devices are frequently deployed in critical environments where replacement is costly or operationally disruptive, leading organizations to keep them online despite the risks.

As a result, unpatched legacy IoT systems remain a persistent attack surface that can be leveraged for data breaches, lateral movement, or inclusion in botnets — making their identification, isolation, or secure retirement a crucial part of modern cybersecurity strategy.