What is the CVSS score of CVE-2026-30650?

CVE-2026-30650 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Vivotek FD8136 are affected by CVE-2026-30650?

Vivotek FD8136 IP cameras contain a high-severity remote code execution vulnerability enabling root-level device compromise through the administrative interface.

How to fix or mitigate CVE-2026-30650?

Within 24 hours: Inventory all Vivotek FD8136 cameras running firmware FD8136-VVTK-0300a; assess network accessibility of /cgi-bin/admin/eventtask.cgi endpoint from untrusted segments; review administrative credential usage patterns. Within 7 days: Implement firewall rules restricting admin interface access to documented administrative IP ranges only; rotate all administrative credentials and disable shared/default accounts; enable logging on admin endpoint access; isolate camera networks from sensitive infrastructure. Within 30 days: Contact Vivotek for firmware update availability (FD8136-VVTK-0300b or later) and end-of-life status; if updates are unavailable, evaluate replacement with actively-maintained camera models; develop staged deployment plan for any available firmware updates.

Vivotek FD8136 CVE-2026-30650

EUVD-2026-33967 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-02 mitre

GHSA-pxcx-h7gm-pxc9

Buffer Overflow RCE N A

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 16:22 vuln.today

CVSS changed

Jun 03, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 02, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A post-authentication remote buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. This flaw allows an authenticated attacker to execute arbitrary code as root on the device remotely.

AnalysisAI

Remote code execution in Vivotek FD8136 IP cameras running firmware FD8136-VVTK-0300a allows authenticated attackers to gain root-level command execution by triggering a buffer overflow in the /cgi-bin/admin/eventtask.cgi admin endpoint. Publicly available exploit code exists in a GitHub research repository, though EPSS scoring (0.09%, 25th percentile) suggests low observed exploitation activity and the CVE is not listed in CISA KEV.

Technical ContextAI

The flaw is a classic CWE-120 buffer copy without checking input size, residing in a CGI binary (eventtask.cgi) that handles event-task configuration within the camera's web administration interface. Vivotek FD8136 is a fixed-dome network surveillance camera that exposes a Linux-based embedded web server; CGI binaries on such devices typically run as root, which directly explains the high-impact outcome. Because the vulnerable code path lives in the admin CGI handler, exploitation requires interacting with the authenticated admin web interface over HTTP(S), and the unbounded copy almost certainly corrupts the stack of the CGI process, enabling control-flow hijack on a platform that usually lacks modern mitigations (ASLR/NX/stack canaries) common in embedded firmware of this generation.

RemediationAI

No vendor-released patch identified at time of analysis - neither the NVD entry nor the EUVD record cites a fixed firmware version, and the only vendor reference is the generic Vivotek homepage. Operators should check Vivotek's product support pages for a firmware update superseding FD8136-VVTK-0300a and apply it once published. In the interim, restrict reachability of the admin interface by placing cameras on a segmented management VLAN, blocking inbound access to /cgi-bin/admin/* from untrusted networks via an upstream reverse proxy or firewall ACL, and enforcing strong, unique admin credentials (since the bug is post-authentication, credential hygiene materially raises the bar). Disabling remote admin access entirely and managing the camera only from a jump host is the most robust compensating control; the trade-off is loss of remote configuration convenience. Researchers have published technical details at https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-30650, which defenders can use to build IDS/WAF signatures for oversized parameters to eventtask.cgi.