A stack‑based buffer overflow exists in the motion_privacy.cgi binary of VIVOTEK FD8136 firmware FD8136-VVTK-0300a. An authenticated remote attacker can send a POST request to the /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profile.cgi endpoints (all symlinks to the same binary) with an oversized n1 parameter. The parameter value is copied into a fixed‑size 0xa4‑byte stack buffer without bounds checking, overwriting the saved link register, and the binary lacks stack canaries. The resulting vulnerability allows arbitrary code execution with root privileges.

Only VIVOTEK FD8136 devices that are running firmware version FD8136-VVTK-0300a are affected. This firmware hosts the motion_privacy.cgi binary and the CGI endpoints mentioned in the description.

The potential impact is severe; an attacker who can authenticate to the device can run arbitrary code as root, compromising the entire camera system. The CVSS score is not publicly available, and the EPSS score is not listed, but due to the nature of the flaw and the absence of mitigation mechanisms such as stack canaries, the likelihood of exploitation in a targeted context remains high. The vulnerability is not listed in the CISA KEV catalog at present, but that does not reduce its risk.