Executive brief
A security vulnerability has been identified in VIVOTEK FD8136 network cameras, which are used for professional video surveillance. An attacker can exploit this flaw to take complete control of the camera without needing a username or password. This could allow an unauthorized person to view private video feeds, disable the camera, or use the device as a foothold to attack other parts of the corporate network.
Technical details
A pre-authentication stack buffer overflow exists in the /cgi-bin/anonymous/setparam.cgi endpoint (a symlink to set_getparam.cgi) of VIVOTEK FD8136 cameras. The vulnerability is caused by the use of the unsafe 'sprintf' function within the set_get_param function, which copies an attacker-controlled POST body into a fixed-size stack buffer without bounds checking. Because the device lacks modern exploit mitigations—specifically lacking stack canaries and utilizing a non-randomized, executable heap—an unauthenticated remote attacker can overwrite the saved return address to redirect execution to shellcode staged in the heap. This allows for full system compromise with root privileges. The issue was identified in firmware version FD8136-VVTK-0300a.
Affected products
- VIVOTEK INC FD8136 FD8136-VVTK-0300a
Timeline
- 2026-05: disclosed: Discovered by Lewis Patten
- 2026-06-02: advisory: NVD publication date