CVE-2026-30652: A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo

Synopsis

A stack-based buffer overflow in the /cgi-bin/dido/setdo.cgi endpoint of the Vivotek FD8136 camera admin interface allows a network-reachable, authenticated attacker to execute arbitrary code as root on the device. The vulnerability is reachable over the network and requires a valid (low-privilege) account on the admin interface. Successful exploitation gives the attacker full root-level code execution on the affected camera. No upstream fix has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the camera's admin interface over the network; the vulnerable CGI endpoint is exposed via HTTP/HTTPS on the device's management plane.

• AuthenticationRequired

  A valid account on the camera's admin interface is required, though any low-privilege credential is sufficient to trigger the overflow.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends a crafted request directly to the endpoint without any user involvement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions, race conditions, or memory-layout dependencies on the attacker.

Blast Radius

• The attacker gains arbitrary code execution as root on the camera, giving full control over the device's operating system and all processes running on it.
• All video streams, stored recordings, and credentials held on the device are readable by the attacker.
• The attacker can modify device configuration, disable recording, or redirect video feeds, corrupting the integrity of the surveillance system.
• The camera process and management interface can be crashed or rendered permanently unavailable, disrupting physical-security monitoring.