Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2018-14496: Vivotek FD8136 firmware lets attackers run code remotely
CVE-2018-14496 · published 7 years ago
Summary
The FD8136 camera’s firmware can be tricked into executing malicious code from a distance due to a coding mistake in its web interface. This could allow an unauthorized person to take control of the device or its network. Apply the vendor’s latest firmware update or disable the affected web function until a fix is available.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| vivotek | fd8136_firmware |
0301a cpe:2.3:o:vivotek:fd8136_firmware:0301a:*:*:*:*:*:*:* |
Original advisory text
Vivotek FD8136 devices allow remote memory corruption and remote code execution because of a stack-based buffer overflow, related to sprintf, vlocal_buff_4326, and set_getparam.cgi. NOTE: The vendo...
Vivotek FD8136 devices allow remote memory corruption and remote code execution because of a stack-based buffer overflow, related to sprintf, vlocal_buff_4326, and set_getparam.cgi. NOTE: The vendor has disputed this as a vulnerability and states that the issue does not cause a web server crash or have any other affect on it's performance
References
- https://www.vdalabs.com/2018/07/23/professional-iot-hacking-series-target-select... Exploit Third Party Advisory
- https://www.vdalabs.com/2018/11/29/professional-iot-hacking-series-hunting-remot... Exploit Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-787Out-of-bounds Write
Timeline
Published10 Jul 2019
Updated24 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-14496 · NVD
Track software like this
Free during beta