What is the CVSS score of CVE-2026-30652?

CVE-2026-30652 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Vivotek FD8136 are affected by CVE-2026-30652?

Vivotek FD8136 IP cameras running firmware FD8136-VVTK-0300a are vulnerable to authenticated remote code execution with root privileges via a buffer overflow in the administrative interface,…

How to fix or mitigate CVE-2026-30652?

24 hours: Inventory all Vivotek FD8136 cameras running firmware FD8136-VVTK-0300a and restrict admin interface access to trusted networks via firewall rules. 7 days: Rotate all administrative credentials, disable remote management if not required, and isolate camera management to a dedicated VLAN with strict segmentation. 30 days: Contact Vivotek for patch availability timeline; evaluate replacement cameras with active vendor support; implement network segmentation to limit lateral movement from compromised camera systems.

Vivotek FD8136 CVE-2026-30652

EUVD-2026-33968 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-02 mitre

GHSA-qp5w-cf66-hcww

RCE Buffer Overflow N A

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 18:52 vuln.today

CVSS changed

Jun 03, 2026 - 18:52 NVD

8.8 (HIGH)

CVE Published

Jun 02, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. This flaw allows an authenticated attacker to execute arbitrary code as root on the device.

AnalysisAI

Authenticated remote code execution in Vivotek FD8136 IP cameras running firmware FD8136-VVTK-0300a allows attackers with valid admin-interface credentials to overflow a buffer in the /cgi-bin/dido/setdo.cgi endpoint and execute arbitrary code as root. No public exploit identified at time of analysis, though a vulnerability research repository on GitHub describes the issue, and EPSS estimates exploitation probability at 0.05% (17th percentile), suggesting low broad-scale exploitation interest despite the high CVSS 8.8 score.

Technical ContextAI

The Vivotek FD8136 is a fixed-dome network surveillance camera whose web administration interface exposes CGI handlers under /cgi-bin/dido/ for controlling digital input/output (DIDO) signaling. The setdo.cgi handler processes attacker-supplied parameters without proper bounds checking, leading to a classic CWE-120 (Classic Buffer Overflow / Buffer Copy without Checking Size of Input) condition in the camera's embedded HTTP service. Because the camera firmware runs CGI processes as root - typical of low-cost embedded Linux IP cameras - corrupting the stack or adjacent memory in this handler grants full device control. The CPE entry from the source (cpe:2.3:a:n/a:n/a) is non-informative and does not pin the affected component beyond what the description states.

RemediationAI

No vendor-released patch identified at time of analysis - the only vendor reference is the generic http://vivotek.com homepage, so administrators should contact Vivotek support or monitor the FD8136 product page for a firmware release superseding FD8136-VVTK-0300a. In the interim, compensating controls include placing affected cameras on an isolated management VLAN reachable only from a hardened jump host (trade-off: breaks any direct NVR/VMS integrations that bypass the segment), blocking inbound access to /cgi-bin/dido/setdo.cgi at an upstream reverse proxy or firewall (trade-off: disables remote DIDO automation features), rotating admin credentials and removing any low-privilege accounts that are not strictly required (since PR:L is the gating prerequisite), and disabling the camera's web interface entirely if device configuration is managed via ONVIF or a separate VMS. Defenders should also review the public research repository at https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-30652 for IOCs or detection signatures.