What is the CVSS score of CVE-2026-35718?

CVE-2026-35718 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

VIVOTEK FD8136-VVTK CVE-2026-35718

EUVD-2026-33970 MEDIUM

Path Traversal (CWE-22)

2026-06-02 mitre

GHSA-rw3h-hf66-rvh4

Path Traversal N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 18:53 vuln.today

CVSS changed

Jun 03, 2026 - 18:52 NVD

6.5 (MEDIUM)

CVE Published

Jun 02, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated attackers to read any file on the device via sending a crafted request.

AnalysisAI

Path traversal in VIVOTEK FD8136-VVTK firmware 0300a exposes the full device filesystem to authenticated low-privilege attackers via the /admin/downloadMedias.cgi endpoint. An attacker holding any valid credential can craft a request with directory traversal sequences to read arbitrary files - including configuration data, credentials, or private keys stored on the device. No confirmed active exploitation (not in CISA KEV), but a vulnerability research repository on GitHub exists for this CVE, and EPSS is very low at 0.02%, suggesting limited widespread attacker awareness at time of analysis.

Technical ContextAI

The VIVOTEK FD8136-VVTK is a network IP camera running an embedded Linux-based firmware. The vulnerable component is a CGI script, /admin/downloadMedias.cgi, which is intended to serve media files from the device. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) identifies the root cause: the script fails to sanitize user-supplied filename parameters, allowing traversal sequences such as '../../' to escape the intended media directory and reference arbitrary filesystem paths. Because this is an embedded device, sensitive files such as /etc/passwd, private SSL keys, or camera configuration files containing credentials may be readable. The NVD CPE is listed as n/a, limiting automated asset identification, but the affected product and firmware version (0300a) are explicitly stated in the CVE description.

RemediationAI

No vendor-released patch has been identified at time of analysis - organizations should monitor http://vivotek.com for a firmware update addressing CVE-2026-35718 and apply it immediately upon release. As compensating controls: restrict network access to the camera's web administration interface (/admin/*) using firewall rules or VLAN segmentation so that only trusted management hosts can reach port 80/443 on affected devices - this prevents unauthenticated network actors from reaching the vulnerable endpoint even if they obtain credentials. If remote web administration is not operationally required, disable it entirely in the camera's configuration. Rotate any credentials stored on or used by affected cameras, as these may have been exfiltrated if the device was previously accessible to untrusted parties. Deploy IDS/WAF rules to detect requests to /admin/downloadMedias.cgi containing traversal sequences (e.g., '../', '%2e%2e%2f') as a detection measure. Note: network segmentation does not remediate the vulnerability - it reduces exposure while awaiting a patch.