CVE-2026-30649: Buffer Overflow
Buffer Overflow vulnerability in VIVOTEK INC FD8136-VVTK-0300a allows a remote attacker to execute arbitrary code via the setgetparam.cgi component
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or remove the set_getparam.cgi component on the device to prevent remote exploitation via this vulnerable CGI endpoint.
VIVOTEK FD8136-VVTK-0300a set_getparam.cgi set_getparam.cgi enabled = false - Compensating control
Restrict network access to the affected device and its management/CGI endpoints to trusted IPs or networks using firewall rules, VPN access, or network segmentation; block or do not expose the device to untrusted/public networks until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30649?
CVE-2026-30649 has a high severity score of 7.3 on the CVSS scale.
How do I fix CVE-2026-30649?
To fix CVE-2026-30649, update your Vivotek FD8136-VVTK-0300a firmware to the latest version as provided by the manufacturer.
What type of vulnerability is CVE-2026-30649?
CVE-2026-30649 is classified as a Buffer Overflow vulnerability.
What impact does CVE-2026-30649 have?
CVE-2026-30649 allows a remote attacker to execute arbitrary code on affected devices.
Which products are affected by CVE-2026-30649?
CVE-2026-30649 affects the Vivotek FD8136-VVTK-0300a camera and its firmware.