CVE-2026-35718

Summary: CVE-2026-35718 is a path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK FD8136-VVTK firmware 0300a. Affected component: firmware running on VIVOTEK FD8136-VVTK. Root cause: crafted requests allow traversal to read arbitrary files due to improper input handli...

CVE-2026-35717

CVE-2026-35717 affects VIVOTEK FD8136 firmware FD8136-VVTK-0300a, specifically the export_language.cgi endpoint. The vulnerability is a stack-based buffer overflow where the handler passes the attacker-controlled Content-Length value directly to fread() as the read size into a fixed-size 0x60-byt...

CVE-2026-30652

Affected product: Vivotek FD8136 cameras running firmware FD8136-VVTK-0300a. Vulnerable component: admin interface endpoint /cgi-bin/dido/setdo.cgi. Root cause: remote buffer overflow allowing an authenticated attacker to execute arbitrary code as root. Impact: high (remote code execution). Explo...

CVE-2026-30649

CVE-2026-30649 reports a Buffer Overflow in VIVOTEK INC FD8136-VVTK-0300a, exploitable remotely via the set_getparam.cgi component. This vulnerability could allow an attacker to execute arbitrary code on affected devices. The CVE records list the vulnerable product (FD8136-VVTK-0300a) and the aff...

CVE-2026-30650

Vivotek FD8136 cameras (firmware FD8136-VVTK-0300a) expose a post-authentication remote buffer overflow in the /cgi-bin/admin/eventtask.cgi endpoint. An authenticated attacker can remotely execute arbitrary code with root privileges. The issue is characterized by CVE-2026-30650 with a high impact...

CVE-2026-35716

CVE-2026-35716 describes a stack-based buffer overflow in the motion_privacy.cgi binary of VIVOTEK FD8136 firmware (FD8136-VVTK-0300a). The issue occurs when an oversized n1 parameter in a POST request to endpoints /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profil...