Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A stack-based buffer overflow in the export_language.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request to the /cgi-bin/admin/export_language.cgi endpoint. The handler passes the attacker-controlled Content-Length value directly to fread() as the read size into a fixed-size 0x60-byte stack buffer, overwriting the saved link register. The binary is compiled without stack canaries.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
CVE-2026-35717 Stack-Based Buffer Overflow in VIVOTEK FD8136 Export Language CGI Binary https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35717
Post summary
CVE-2026-35717 describes a stack-based buffer overflow in VIVOTEK FD8136's Export Language CGI Binary, with no evidence of active exploitation, patches, or PoC details.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | vivotek | fd8136 | - | - | - |
| OS | vivotek | fd8136_firmware | 0300a | - | - |