The vulnerability is a classic buffer overflow in the set_getparam.cgi component of VIVOTEK INC FD8136-VVTK-0300a firmware. An attacker who can reach the device’s web interface can supply an oversized payload that overwrites memory and gains arbitrary code execution, directly compromising the confidentiality, integrity, and availability of the device and any systems it connects to.

VIVOTEK’s FD8136-VVTK-0300a camera firmware is affected. No specific firmware revisions are listed, so any deployment of this product model should be reviewed for the presence of the set_getparam.cgi component. Users should verify the firmware version and consult VIVOTEK documentation.

The risk is high because the flaw enables remote code execution via a web interface that is typically reachable over the network. The CVSS score of 7.3 indicates a high severity, and the EPSS score is less than 1%, suggesting a low likelihood but still possible exploitation. The vulnerability is not listed in CISA’s KEV catalog, but the lack of mitigation data does not reduce the severity implied by the CVE description. Attackers can exploit this remotely without user interaction, making the window of opportunity large. Organizations should treat this as a critical threat.