Executive brief
A security vulnerability exists in VIVOTEK FD8136 network cameras, which are used for professional video surveillance. An authorized user can send a specially crafted web request to the device to take complete control of the camera's operating system. This could allow an attacker to disable surveillance, access private video feeds, or use the device as a foothold to attack other parts of the corporate network.
Technical details
A stack-based buffer overflow exists in the 'export_language.cgi' binary of VIVOTEK FD8136 cameras running firmware version FD8136-VVTK-0300a. The vulnerability is located in the handler for the '/cgi-bin/admin/export_language.cgi' endpoint, which processes POST requests. The application reads attacker-controlled data from stdin and uses a length derived from the 'Content-Length' header or the input itself to perform a memory copy into a fixed-size 0x60-byte stack buffer without bounds checking. Because the binary is compiled without stack canaries, an authenticated attacker can overwrite the saved link register to redirect execution flow. Successful exploitation allows for arbitrary code execution with root privileges.
Affected products
- VIVOTEK FD8136 firmware FD8136-VVTK-0300a
Timeline
- 2026-05: disclosed: Discovered by Lewis Patten
- 2026-06-02: advisory: NVD publication date