CVE-2026-35716

A stack-based buffer overflow in the motion_privacy.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via an oversized n1 parameter in a POST request to the /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profile.cgi endpoint (all symlinks to the same binary). The parameter value is copied into a fixed-size 0xa4-byte stack buffer without bounds checking, overwriting the saved link register. The binary is compiled without stack canaries.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-35716	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:vivotek:fd8136_firmware:0300a:*:*:*:*:*:*:*

cpe:2.3:h:vivotek:fd8136:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-02 16:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-35716

Mitre link : CVE-2026-35716

CVE.ORG link : CVE-2026-35716

JSON object : View

Products Affected

vivotek

fd8136
fd8136_firmware

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-35716", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35716", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-03T13:38:27.964339Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-06-02T16:16:37.187", "references": [{"url": "https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-35716", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow in the motion_privacy.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via an oversized n1 parameter in a POST request to the /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profile.cgi endpoint (all symlinks to the same binary). The parameter value is copied into a fixed-size 0xa4-byte stack buffer without bounds checking, overwriting the saved link register. The binary is compiled without stack canaries."}, {"lang": "es", "value": "Un desbordamiento de b\u00fafer basado en pila en el binario motion_privacy.cgi en el firmware VIVOTEK FD8136 FD8136-VVTK-0300a permite a atacantes remotos autenticados ejecutar c\u00f3digo arbitrario como root a trav\u00e9s de un par\u00e1metro n1 sobredimensionado en una solicitud POST al endpoint /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, o /cgi-bin/admin/setmd_profile.cgi (todos enlaces simb\u00f3licos al mismo binario). El valor del par\u00e1metro se copia en un b\u00fafer de pila de tama\u00f1o fijo de 0xa4 bytes sin comprobaci\u00f3n de l\u00edmites, sobrescribiendo el registro de enlace guardado. El binario se compila sin canarios de pila."}], "lastModified": "2026-07-22T19:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:vivotek:fd8136_firmware:0300a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3E87285-9E56-4692-A236-C3A3E277AA03"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:vivotek:fd8136:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "23008BB5-E0BD-482E-BB65-419C009847A8"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}