# CVE-2026-30652: Vivotek FD8136 buffer overflow in setdo.cgi

Source: https://junglewise.ai/threats/cve-2026-30652-vivotek-fd8136-buffer-overflow-in-setdo-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-30652 · Severity: info · CVSS 8.8 · Published 2026-06-02

Vivotek FD8136 network cameras are affected by a security flaw in their administrative interface. An authorized user can send a specially crafted request to the device to take complete control of the camera. This could allow an attacker to view private video feeds, disable the camera, or use the device as a foothold to attack other parts of the corporate network.

Technologies: [VIVOTEK FD8136](https://junglewise.ai/threats/technologies/fd8136). Vendors: [VIVOTEK](https://junglewise.ai/threats/vendors/vivotek).

## Quick answers

**Is CVE-2026-30652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30652 being exploited in the wild.

**How severe is CVE-2026-30652?** Informational severity, with a CVSS score of 8.8, published 2 June 2026.

**Which products and versions are affected?** VIVOTEK FD8136 FD8136-VVTK-0300a.

**Is there a fix for CVE-2026-30652?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-30652 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-30652?** Check whether you run VIVOTEK FD8136 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the set_getdido.cgi binary, which handles requests for the /cgi-bin/dido/setdo.cgi endpoint on Vivotek FD8136 cameras. The vulnerability occurs because the application reads the raw POST request body into a fixed-size stack buffer (approximately 196 bytes) without performing bounds checking. An authenticated attacker can exploit this by sending a POST body exceeding the buffer size, allowing them to overwrite the saved link register and redirect execution flow. The affected binary lacks stack canaries, facilitating straightforward exploitation to achieve root-level code execution.

## Affected products

- Vivotek FD8136 FD8136-VVTK-0300a

## Timeline

- 2026-05: other: Vulnerability discovered by Lewis Patten
- 2026-06-02: advisory: CVE-2026-30652 published by NVD/MITRE

## References

- [http://vivotek.com/](http://vivotek.com/)
- [https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-30652](https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-30652)

## Related threats

- [Vivotek FD8136 buffer overflow in eventtask.cgi](https://junglewise.ai/threats/cve-2026-30650-vivotek-fd8136-buffer-overflow-in-eventtask-cgi)
- [VIVOTEK FD8136 stack buffer overflow in set_getparam.cgi](https://junglewise.ai/threats/cve-2026-30649-vivotek-fd8136-stack-buffer-overflow-in-set-getparam-cgi)