CVE-2020-11949

CVE-2020-11949 affects VIVOTEK Network Cameras and their web service (testserver.cgi) before XXXXX-VVTK-2.2002.xx.01x and before XXXXX-VVTK-0XXXX_Beta2. An authenticated user can obtain arbitrary files from a camera’s local filesystem (affecting devices such as IT9388-HT). The underlying cause is...

CVE-2020-11950

CVE-2020-11950 affects VIVOTEK Network Cameras prior to XXXXX-VVTK-2.2002.xx.01x and prior to XXXXX-VVTK-0XXXX_Beta2, where an authenticated user can upload and execute a script, resulting in OS command execution (example affected device: IT9388-HT).

CVE-2024-7443

CVE-2024-7443 affects Vivotek IB8367A VVTK-0100b. The vulnerability targets the getenv function in upload_file.cgi, where manipulation of QUERY_STRING enables command injection over the network. The issue is exploitable remotely and the affected releases are end-of-life; vendor support has ended ...