CVE-2026-30650: A post-authentication remote buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask

Synopsis

A stack-based buffer overflow affects the /cgi-bin/admin/eventtask.cgi endpoint in the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. The vulnerability is reachable over the network and requires a low-privilege authenticated session, meaning any account with login access is sufficient to trigger it. Successful exploitation gives the attacker arbitrary code execution as root on the camera. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the camera's admin web interface over the network; the vulnerable CGI endpoint is exposed via HTTP/HTTPS on the device's network-facing admin port.

• AuthenticationRequired

  A valid account on the admin interface is required, but any low-privilege account is sufficient to trigger the overflow.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker sends a crafted request directly to the endpoint.

• Attack complexityDetail

  Exploit complexity is low, meaning the attack is reliable and requires no special timing, race conditions, or environmental pre-conditions beyond network access and a valid session.

Blast Radius

• A successful attacker gains arbitrary code execution running as root, giving full control over the camera's operating environment.
• The attacker can read all data accessible on the device, including stored credentials, configuration files, and any cached video streams or snapshots.
• The attacker can modify device configuration, disable security controls, or install persistent backdoors in firmware-writable storage.
• The attacker can crash or disable the camera entirely, disrupting physical security monitoring for the affected location.