Executive brief
A security vulnerability exists in VIVOTEK FD8136 network cameras, which are used for professional video surveillance. An attacker with valid login credentials can send a specially crafted web request to the camera to take full control of the device. This could allow an unauthorized user to view private video feeds, disable security monitoring, or use the camera as a foothold to attack other parts of the corporate network.
Technical details
A stack-based buffer overflow exists in the motion_privacy.cgi binary within VIVOTEK FD8136 firmware version FD8136-VVTK-0300a. The vulnerability is triggered when processing POST requests to the /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profile.cgi endpoints. The application fails to perform bounds checking when copying the 'n1' parameter into a fixed-size 0xa4-byte stack buffer. Because the binary is compiled without stack canaries, an authenticated attacker can overwrite the saved link register to redirect control flow and execute arbitrary code with root privileges.
Affected products
- VIVOTEK FD8136 firmware FD8136-VVTK-0300a
Timeline
- 2026-05: disclosed: Discovered by Lewis Patten
- 2026-06-02: advisory: CVE published to NVD