CVE-2026-30650
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A post-authentication buffer overflow vulnerability in the /cgi-bin/admin/eventtask.cgi endpoint of the Vivotek FD8136 camera with firmware FD8136-VVTK-0300a allows an authenticated attacker to execute arbitrary code as root remotely.
Risk Assessment
An attacker with admin panel access could fully compromise the camera, potentially leading to surveillance or use in a botnet.
Recommendation
Update the camera firmware to the latest version and restrict access to the admin interface to trusted networks only.
Other vulnerabilities in Vivotek FD8136
See all- CVE-2026-30652High
A remote buffer overflow vulnerability in the /cgi-bin/dido/setdo.cgi endpoint of Vivotek FD8136 cameras (firmware FD8136-VVTK-0300a) allows an authenticated attacker to execute arbitrary code as root.
- CVE-2026-35717Medium
A stack-based buffer overflow in export_language.cgi on VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request with a controlled Content-Length value.
Original NVD description (English source)
A post-authentication remote buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. This flaw allows an authenticated attacker to execute arbitrary code as root on the device remotely.