Is CVE-2026-35718 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35718 being exploited in the wild.

How severe is CVE-2026-35718?

Informational severity, with a CVSS score of 0, published 2 June 2026.

Which products and versions are affected?

VIVOTEK FD8136-VVTK firmware 0300a.

Is there a fix for CVE-2026-35718?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-35718 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-35718?

Check whether you run VIVOTEK FD8136-VVTK firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35718: VIVOTEK FD8136 path traversal in downloadMedias.cgi

CVE-2026-35718 · Severity: info · CVSS 0 · Published 2026-06-02

A security vulnerability exists in VIVOTEK FD8136 network cameras, which are used for professional video surveillance. An authorized user can bypass security restrictions to access sensitive system files that should normally be protected. This could lead to the exposure of device configurations, network details, or credentials, potentially allowing for further unauthorized access to the camera system.

Vendors: VIVOTEK.

Quick answers

Is CVE-2026-35718 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35718 being exploited in the wild.
How severe is CVE-2026-35718?: Informational severity, with a CVSS score of 0, published 2 June 2026.
Which products and versions are affected?: VIVOTEK FD8136-VVTK firmware 0300a.
Is there a fix for CVE-2026-35718?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-35718 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-35718?: Check whether you run VIVOTEK FD8136-VVTK firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the /cgi-bin/admin/downloadMedias.cgi shell script on VIVOTEK FD8136 devices running firmware version 0300a. The script is intended to allow authenticated users to download media files from the /mnt/auto/ directory. However, the application only performs a weak prefix check using 'cut' to ensure the path starts with '/mnt/auto/' and fails to sanitize for directory traversal sequences (../). By providing a crafted path such as '/mnt/auto/../../../etc/passwd', an authenticated attacker can bypass the prefix check and use the 'cat' command within the script to read arbitrary files from the underlying Linux filesystem.

Affected products

VIVOTEK INC FD8136-VVTK firmware 0300a

Timeline

2026-05: other: Discovered by Lewis Patten
2026-06-02: advisory: CVE published by NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.