CVE-2026-30650
Description
Authenticated buffer overflow in Vivotek FD8136 cameras allows remote code execution as root.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Authenticated buffer overflow in Vivotek FD8136 cameras allows remote code execution as root.
Vulnerability
A post-authentication stack buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask.cgi endpoint of the Vivotek FD8136 camera's admin interface, specifically affecting firmware version FD8136-VVTK-0300a [2]. The vulnerability occurs when the eventtask.cgi binary processes a POST request by reading the raw request body from stdin into a fixed-size stack buffer of approximately 0x88 bytes without validating the input length against the buffer's capacity.
Exploitation
An authenticated attacker can exploit this vulnerability by sending a POST request to the /cgi-bin/admin/eventtask.cgi endpoint with a request body larger than 0x88 bytes [2]. This overflow overwrites the saved link register on the stack, allowing the attacker to redirect control flow. The binary lacks stack canaries and other memory protections, simplifying exploitation.
Impact
Successful exploitation allows an authenticated attacker to execute arbitrary commands as root on the affected Vivotek FD8136 camera [2]. This grants the attacker full control over the device.
Mitigation
Firmware version FD8136-VVTK-0300a is affected by this vulnerability [2]. Information regarding a patched firmware version or a release date for a fix is not yet disclosed in the available references. Vivotek's general product information is available [1].
AI Insight generated on Jun 2, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
2News mentions
0No linked articles in our index yet.