Lewis Patten

**Name of the Vulnerable Software and Affected Versions** VIVOTEK INC FD8136-VVTK-0300a (affected versions not specified) **Description** A buffer overflow allows a remote attacker to execute arbitrary code via the 'set getparam.cgi' component. A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it is allocated to hold, potentially overwriting adjacent memory locations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vivotek FD8136 version FD8136-VVTK-0300a **Description** A remote buffer overflow occurs in the admin interface. An authenticated attacker can exploit this to execute arbitrary code with root privileges on the device via the '/cgi-bin/dido/setdo.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VIVOTEK INC FD8136-VVTK version 0300a **Description** A path traversal issue exists in the '/admin/downloadMedias.cgi' endpoint. This allows authenticated attackers to read arbitrary files on the device by sending a specially crafted request. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.