CVE-2026-35717: Vivotek FD8136 Firmware

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A stack-based buffer overflow in the export_language.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request to the /cgi-bin/admin/export_language.cgi endpoint. The handler passes the attacker-controlled Content-Length value directly to fread() as the read size into a fixed-size 0x60-byte stack buffer, overwriting the saved link register. The binary is compiled without stack canaries.

Affected products

• Vivotek FD8136 Firmware: version 0300a only

Published 2026-06-02. Last modified 2026-07-22.