CVE-2026-35718: Path Traversal
A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated attackers to read any file on the device via sending a crafted request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or restrict access to the /admin/downloadMedias.cgi endpoint and the device's administrative interfaces. If possible, disable remote administration or restrict administrative access to specific trusted IP addresses or networks.
VIVOTEK FD8136-VVTK firmware 0300a /admin/downloadMedias.cgi access = restricted/disabled - Compensating control
Place the device behind network controls (firewall, VLAN segmentation, or VPN) and restrict management-plane access to trusted administrative hosts until a vendor-supplied firmware update is available.
Event History
Frequently Asked Questions
What is CVE-2026-35718?
CVE-2026-35718 is a path traversal vulnerability that allows authenticated attackers to read any file on the device through the /admin/downloadMedias.cgi endpoint in VIVOTEK FD8136-VVTK firmware.
What is the severity of CVE-2026-35718?
CVE-2026-35718 has a medium severity rating of 6.5 according to the CVSS v3.1.
How do I fix CVE-2026-35718?
To fix CVE-2026-35718, update the firmware of VIVOTEK FD8136-VVTK to the latest version provided by VIVOTEK that addresses this vulnerability.
Who is affected by CVE-2026-35718?
CVE-2026-35718 affects users of the VIVOTEK FD8136-VVTK firmware version 0300a and prior.
What type of vulnerability is CVE-2026-35718?
CVE-2026-35718 is classified as a path traversal vulnerability as it allows unauthorized file access through crafted requests.