CVE-2026-30652
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A remote buffer overflow vulnerability in the /cgi-bin/dido/setdo.cgi endpoint of Vivotek FD8136 cameras (firmware FD8136-VVTK-0300a) allows an authenticated attacker to execute arbitrary code as root.
Risk Assessment
An attacker could fully compromise the camera, leading to surveillance or use in a botnet.
Recommendation
Install the firmware update from the vendor or restrict access to the admin interface.
Other vulnerabilities in Vivotek FD8136
See all- CVE-2026-30650High
A post-authentication buffer overflow vulnerability in the /cgi-bin/admin/eventtask.cgi endpoint of the Vivotek FD8136 camera with firmware FD8136-VVTK-0300a allows an authenticated attacker to execute arbitrary code as root remotely.
- CVE-2026-35717Medium
A stack-based buffer overflow in export_language.cgi on VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request with a controlled Content-Length value.
Original NVD description (English source)
A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. This flaw allows an authenticated attacker to execute arbitrary code as root on the device.