EUVD-2026-33966
GHSA-ff48-whph-h93f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Buffer Overflow vulnerability in VIVOTEK INC FD8136-VVTK-0300a allows a remote attacker to execute arbitrary code via the set_getparam.cgi component
AnalysisAI
Remote code execution in VIVOTEK FD8136 network camera (firmware VVTK-0300a) is possible via a stack-based buffer overflow in the set_getparam.cgi component, reachable over the network without authentication. CVSS 7.3 reflects partial CIA impact, but the presence of public vulnerability-research artifacts on GitHub indicates publicly available exploit code exists, while EPSS remains low at 0.05% (17th percentile) and the issue is not currently listed in CISA KEV.
Technical ContextAI
VIVOTEK FD8136 is a fixed-dome IP surveillance camera that exposes a web management interface implemented through CGI binaries, of which set_getparam.cgi is one of the parameter-handling endpoints typically used to read and set device configuration. The root cause is CWE-121 (Stack-based Buffer Overflow), meaning user-supplied input passed to set_getparam.cgi is copied into a fixed-size stack buffer without proper bounds checking, allowing an attacker to overwrite saved return addresses, frame pointers, or adjacent stack data and redirect execution. On embedded camera platforms these CGI binaries usually run with high privileges (often root) under a lightweight HTTP daemon such as Boa or a vendor-customized server, and they are typically built without modern mitigations like full ASLR, stack canaries, or non-executable stacks, making stack overflows highly amenable to reliable code execution.
RemediationAI
No vendor-released patch identified at time of analysis - the references include only the VIVOTEK corporate site, the NVD entry, and a third-party research repository, with no advisory or fixed-firmware version cited. Operators should monitor VIVOTEK's security bulletins at http://vivotek.com for an FD8136 firmware update superseding VVTK-0300a and apply it as soon as available. In the interim, the most effective compensating control is to remove FD8136 cameras from any internet-facing exposure and place them on an isolated management VLAN reachable only from a hardened jump host or VPN, which neutralizes the AV:N attack vector but breaks any remote viewing workflows that bypassed the VMS. Where the camera must remain reachable, restrict inbound TCP to the camera's HTTP/HTTPS management ports (typically 80/443) at the firewall to a narrow allowlist of trusted management IPs and block set_getparam.cgi at an upstream reverse proxy or WAF if one fronts the camera, accepting that this will also break legitimate configuration tooling that calls that endpoint. Pair these controls with monitoring of camera HTTP logs for oversized query strings or POST bodies to set_getparam.cgi, and review the public research at the referenced GitHub repository to derive specific detection signatures.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today