CVE-2026-30652 Details

A remote buffer overflow vulnerability has been identified in the Vivotek FD8136 camera model, specifically in the admin interface endpoint /cgi-bin/dido/setdo.cgi. This vulnerability affects cameras running firmware version FD8136-VVTK-0300a. The issue allows an authenticated attacker to execute arbitrary code as root on the device. The vulnerability arises because the affected CGI endpoint manages the camera's digital input/output configuration but fails to properly validate the length of the data being sent in POST requests. As a result, an attacker can overwrite a fixed-size stack buffer, manipulate the saved link register, and execute malicious code with root privileges.