Is CVE-2026-30649 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30649 being exploited in the wild.

How severe is CVE-2026-30649?

Informational severity, with a CVSS score of 9.8, published 2 June 2026.

Which products and versions are affected?

VIVOTEK FD8136 FD8136-VVTK-0300a.

Is there a fix for CVE-2026-30649?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-30649 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-30649?

Check whether you run VIVOTEK FD8136 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30649: VIVOTEK FD8136 stack buffer overflow in set_getparam.cgi

CVE-2026-30649 · Severity: info · CVSS 9.8 · Published 2026-06-02

A security vulnerability has been identified in VIVOTEK FD8136 network cameras, which are used for professional video surveillance. An attacker can exploit this flaw to take complete control of the camera without needing a username or password. This could allow an unauthorized person to view private video feeds, disable the camera, or use the device as a foothold to attack other parts of the corporate network.

Technologies: VIVOTEK FD8136. Vendors: VIVOTEK.

Quick answers

Is CVE-2026-30649 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30649 being exploited in the wild.
How severe is CVE-2026-30649?: Informational severity, with a CVSS score of 9.8, published 2 June 2026.
Which products and versions are affected?: VIVOTEK FD8136 FD8136-VVTK-0300a.
Is there a fix for CVE-2026-30649?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-30649 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-30649?: Check whether you run VIVOTEK FD8136 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A pre-authentication stack buffer overflow exists in the /cgi-bin/anonymous/setparam.cgi endpoint (a symlink to set_getparam.cgi) of VIVOTEK FD8136 cameras. The vulnerability is caused by the use of the unsafe 'sprintf' function within the set_get_param function, which copies an attacker-controlled POST body into a fixed-size stack buffer without bounds checking. Because the device lacks modern exploit mitigations—specifically lacking stack canaries and utilizing a non-randomized, executable heap—an unauthenticated remote attacker can overwrite the saved return address to redirect execution to shellcode staged in the heap. This allows for full system compromise with root privileges. The issue was identified in firmware version FD8136-VVTK-0300a.

Affected products

VIVOTEK INC FD8136 FD8136-VVTK-0300a

Timeline

2026-05: disclosed: Discovered by Lewis Patten
2026-06-02: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.