What is the CVSS score of CVE-2026-30652?

CVE-2026-30652 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Vivotek FD8136 are affected by CVE-2026-30652?

Vivotek FD8136 IP cameras running firmware FD8136-VVTK-0300a are vulnerable to authenticated remote code execution with root privileges via a buffer overflow in the administrative interface,…

How to fix or mitigate CVE-2026-30652?

24 hours: Inventory all Vivotek FD8136 cameras running firmware FD8136-VVTK-0300a and restrict admin interface access to trusted networks via firewall rules. 7 days: Rotate all administrative credentials, disable remote management if not required, and isolate camera management to a dedicated VLAN with strict segmentation. 30 days: Contact Vivotek for patch availability timeline; evaluate replacement cameras with active vendor support; implement network segmentation to limit lateral movement from compromised camera systems.

Vivotek FD8136 CVE-2026-30652

EUVD-2026-33968 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-02 mitre

GHSA-qp5w-cf66-hcww

Buffer Overflow RCE N A

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 18:52 vuln.today

CVSS changed

Jun 03, 2026 - 18:52 NVD

8.8 (HIGH)

CVE Published

Jun 02, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. This flaw allows an authenticated attacker to execute arbitrary code as root on the device.

AnalysisAI

Authenticated remote code execution in Vivotek FD8136 IP cameras running firmware FD8136-VVTK-0300a allows attackers with valid admin-interface credentials to overflow a buffer in the /cgi-bin/dido/setdo.cgi endpoint and execute arbitrary code as root. No public exploit identified at time of analysis, though a vulnerability research repository on GitHub describes the issue, and EPSS estimates exploitation probability at 0.05% (17th percentile), suggesting low broad-scale exploitation interest despite the high CVSS 8.8 score.

Technical ContextAI

The Vivotek FD8136 is a fixed-dome network surveillance camera whose web administration interface exposes CGI handlers under /cgi-bin/dido/ for controlling digital input/output (DIDO) signaling. The setdo.cgi handler processes attacker-supplied parameters without proper bounds checking, leading to a classic CWE-120 (Classic Buffer Overflow / Buffer Copy without Checking Size of Input) condition in the camera's embedded HTTP service. Because the camera firmware runs CGI processes as root - typical of low-cost embedded Linux IP cameras - corrupting the stack or adjacent memory in this handler grants full device control. The CPE entry from the source (cpe:2.3:a:n/a:n/a) is non-informative and does not pin the affected component beyond what the description states.

RemediationAI

No vendor-released patch identified at time of analysis - the only vendor reference is the generic http://vivotek.com homepage, so administrators should contact Vivotek support or monitor the FD8136 product page for a firmware release superseding FD8136-VVTK-0300a. In the interim, compensating controls include placing affected cameras on an isolated management VLAN reachable only from a hardened jump host (trade-off: breaks any direct NVR/VMS integrations that bypass the segment), blocking inbound access to /cgi-bin/dido/setdo.cgi at an upstream reverse proxy or firewall (trade-off: disables remote DIDO automation features), rotating admin credentials and removing any low-privilege accounts that are not strictly required (since PR:L is the gating prerequisite), and disabling the camera's web interface entirely if device configuration is managed via ONVIF or a separate VMS. Defenders should also review the public research repository at https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-30652 for IOCs or detection signatures.