EUVD-2026-33969
GHSA-pj36-9w4r-h2r4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A stack-based buffer overflow in the motion_privacy.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via an oversized n1 parameter in a POST request to the /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profile.cgi endpoint (all symlinks to the same binary). The parameter value is copied into a fixed-size 0xa4-byte stack buffer without bounds checking, overwriting the saved link register. The binary is compiled without stack canaries.
AnalysisAI
Stack-based buffer overflow in VIVOTEK FD8136 firmware FD8136-VVTK-0300a grants authenticated remote attackers root-level code execution by supplying an oversized POST parameter to any of three symlinked CGI admin endpoints. The vulnerable motion_privacy.cgi binary copies the n1 parameter into a fixed 164-byte (0xa4) stack buffer with no bounds check and no stack canary protection, overwriting the saved link register and diverting execution to attacker-controlled code. A public proof-of-concept is available on GitHub; no active exploitation has been confirmed in CISA KEV at time of analysis.
Technical ContextAI
The root cause is CWE-121 (Stack-based Buffer Overflow) in the motion_privacy.cgi CGI binary embedded in VIVOTEK FD8136 firmware. Three admin endpoints - /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, and /cgi-bin/admin/setmd_profile.cgi - are filesystem symlinks to this single binary, meaning all three paths are equally exploitable. The n1 POST parameter is copied into a stack-allocated buffer of exactly 0xa4 (164) bytes using an unsafe operation with no length validation. Overwriting the saved link register (rather than a return address on x86) indicates the device likely runs an ARM-based SoC, which is standard for embedded IP cameras. The absence of stack canaries removes the primary compile-time detection mechanism for this class of overflow. The NVD CPE entry (cpe:2.3:a:n/a:n/a) is uninformative and does not provide version-range precision beyond what the CVE description states.
RemediationAI
No vendor-released patch or updated firmware version has been identified from the available data - the references include only the vendor's homepage and the researcher's GitHub PoC, with no VIVOTEK security advisory or patched firmware release number. Monitor http://vivotek.com for firmware updates targeting FD8136-VVTK-0300a. Until a patch is available, restrict network access to the three vulnerable endpoints (/cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, /cgi-bin/admin/setmd_profile.cgi) via perimeter firewall or VLAN segmentation, ensuring these cameras are not reachable from untrusted networks; this is the highest-impact compensating control and eliminates the AV:N attack vector entirely at the cost of remote admin access. Additionally, enforce strong, unique administrative credentials across all FD8136 units to raise the bar for the PR:L authentication prerequisite - default or weak credentials would allow any network-reachable attacker to exploit this. The PoC at https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-35716 can be used in a lab environment to validate whether a future firmware update actually resolves the overflow.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today