What is the CVSS score of CVE-2026-30649?

CVE-2026-30649 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of VIVOTEK FD8136 are affected by CVE-2026-30649?

VIVOTEK FD8136 network cameras running firmware VVTK-0300a contain an unauthenticated remote code execution vulnerability for which publicly available exploit code exists, directly threatening…

How to fix or mitigate CVE-2026-30649?

Within 24 hours: Audit all VIVOTEK FD8136 installations to identify those running firmware VVTK-0300a and segregate to isolated VLAN with inbound access restricted. Within 7 days: Contact VIVOTEK for patch timeline and interim firmware updates; implement IP-based access controls limiting management connectivity to authorized administrative networks only. Within 30 days: Either deploy firmware patch upon vendor release or evaluate replacement with cameras from unaffected product lines; implement perimeter controls to block external requests to set_getparam.cgi.

VIVOTEK FD8136 CVE-2026-30649

EUVD-2026-33966 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-02 mitre

GHSA-ff48-whph-h93f

Buffer Overflow RCE Stack Overflow N A

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 14:22 vuln.today

CVSS changed

Jun 03, 2026 - 14:22 NVD

7.3 (HIGH)

CVE Published

Jun 02, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Buffer Overflow vulnerability in VIVOTEK INC FD8136-VVTK-0300a allows a remote attacker to execute arbitrary code via the set_getparam.cgi component

AnalysisAI

Remote code execution in VIVOTEK FD8136 network camera (firmware VVTK-0300a) is possible via a stack-based buffer overflow in the set_getparam.cgi component, reachable over the network without authentication. CVSS 7.3 reflects partial CIA impact, but the presence of public vulnerability-research artifacts on GitHub indicates publicly available exploit code exists, while EPSS remains low at 0.05% (17th percentile) and the issue is not currently listed in CISA KEV.

Technical ContextAI

VIVOTEK FD8136 is a fixed-dome IP surveillance camera that exposes a web management interface implemented through CGI binaries, of which set_getparam.cgi is one of the parameter-handling endpoints typically used to read and set device configuration. The root cause is CWE-121 (Stack-based Buffer Overflow), meaning user-supplied input passed to set_getparam.cgi is copied into a fixed-size stack buffer without proper bounds checking, allowing an attacker to overwrite saved return addresses, frame pointers, or adjacent stack data and redirect execution. On embedded camera platforms these CGI binaries usually run with high privileges (often root) under a lightweight HTTP daemon such as Boa or a vendor-customized server, and they are typically built without modern mitigations like full ASLR, stack canaries, or non-executable stacks, making stack overflows highly amenable to reliable code execution.

RemediationAI

No vendor-released patch identified at time of analysis - the references include only the VIVOTEK corporate site, the NVD entry, and a third-party research repository, with no advisory or fixed-firmware version cited. Operators should monitor VIVOTEK's security bulletins at http://vivotek.com for an FD8136 firmware update superseding VVTK-0300a and apply it as soon as available. In the interim, the most effective compensating control is to remove FD8136 cameras from any internet-facing exposure and place them on an isolated management VLAN reachable only from a hardened jump host or VPN, which neutralizes the AV:N attack vector but breaks any remote viewing workflows that bypassed the VMS. Where the camera must remain reachable, restrict inbound TCP to the camera's HTTP/HTTPS management ports (typically 80/443) at the firewall to a narrow allowlist of trusted management IPs and block set_getparam.cgi at an upstream reverse proxy or WAF if one fronts the camera, accepting that this will also break legitimate configuration tooling that calls that endpoint. Pair these controls with monitoring of camera HTTP logs for oversized query strings or POST bodies to set_getparam.cgi, and review the public research at the referenced GitHub repository to derive specific detection signatures.