Executive brief
Vivotek FD8136 network cameras are affected by a security flaw in their administrative interface. An authorized user can send a specially crafted request to the device to take complete control of the camera. This could allow an attacker to view private video feeds, disable the camera, or use the device as a foothold to attack other parts of the corporate network.
Technical details
A stack-based buffer overflow exists in the set_getdido.cgi binary, which handles requests for the /cgi-bin/dido/setdo.cgi endpoint on Vivotek FD8136 cameras. The vulnerability occurs because the application reads the raw POST request body into a fixed-size stack buffer (approximately 196 bytes) without performing bounds checking. An authenticated attacker can exploit this by sending a POST body exceeding the buffer size, allowing them to overwrite the saved link register and redirect execution flow. The affected binary lacks stack canaries, facilitating straightforward exploitation to achieve root-level code execution.
Affected products
- Vivotek FD8136 FD8136-VVTK-0300a
Timeline
- 2026-05: other: Vulnerability discovered by Lewis Patten
- 2026-06-02: advisory: CVE-2026-30652 published by NVD/MITRE