Executive brief
A security vulnerability exists in VIVOTEK FD8136 network cameras, which are used for professional video surveillance. An authorized user can bypass security restrictions to access sensitive system files that should normally be protected. This could lead to the exposure of device configurations, network details, or credentials, potentially allowing for further unauthorized access to the camera system.
Technical details
A path traversal vulnerability exists in the /cgi-bin/admin/downloadMedias.cgi shell script on VIVOTEK FD8136 devices running firmware version 0300a. The script is intended to allow authenticated users to download media files from the /mnt/auto/ directory. However, the application only performs a weak prefix check using 'cut' to ensure the path starts with '/mnt/auto/' and fails to sanitize for directory traversal sequences (../). By providing a crafted path such as '/mnt/auto/../../../etc/passwd', an authenticated attacker can bypass the prefix check and use the 'cat' command within the script to read arbitrary files from the underlying Linux filesystem.
Affected products
- VIVOTEK INC FD8136-VVTK firmware 0300a
Timeline
- 2026-05: other: Discovered by Lewis Patten
- 2026-06-02: advisory: CVE published by NVD