CVE-2026-30649: Buffer Overflow vulnerability in VIVOTEK INC FD8136-VVTK-0300a allows a remote attacker to execute arbitrary code via the set_getparam

Synopsis

A buffer overflow vulnerability affects the VIVOTEK INC FD8136-VVTK-0300a network camera firmware, specifically in the set_getparam.cgi component. The flaw is reachable over the network without any authentication, meaning any attacker who can reach the device's web interface can attempt exploitation. Successful exploitation gives the attacker arbitrary code execution on the device. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched rebuild available as soon as an upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the device's web interface over the network; the vulnerable component is exposed via HTTP.

• AuthenticationNot required

  No credentials are needed; the set_getparam.cgi endpoint is accessible without any login.

• Victim interactionNot required

  No user or operator action is required; the attacker sends a crafted request directly to the device.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or memory-layout knowledge.

Blast Radius

• The attacker executes arbitrary code on the camera's firmware, gaining full control of the device process.
• Confidentiality impact is present: the attacker reads data accessible to the compromised process, which may include stored credentials, stream configurations, or captured video.
• Integrity impact is present: the attacker modifies firmware state, configuration files, or persisted settings on the device.
• Availability impact is present: the attacker can crash or restart the camera service, interrupting video capture and monitoring.