QSearchQSearch

CVE-2026-35718

6.5 MEDIUM

A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated a...

Published: 2026-06-02 · Last updated: 2026-06-03

Severity and scoring

CVSS
6.5 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
CWE-22

Affected products

VendorProduct
vivotekfd8136_firmware

Description

A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated attackers to read any file on the device via sending a crafted request.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-35716 — A stack-based buffer overflow in the motion_privacy.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote a... (6.3 MEDIUM)
  • CVE-2026-30652 — A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras ru... (8.8 HIGH)
  • CVE-2026-30650 — A post-authentication remote buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask.cgi endpoint of the admin interface of ... (8.8 HIGH)
  • CVE-2026-30649 — Buffer Overflow vulnerability in VIVOTEK INC FD8136-VVTK-0300a allows a remote attacker to execute arbitrary code via the set_getparam.cg... (7.3 HIGH)
  • CVE-2026-35717 — A stack-based buffer overflow in the export_language.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote ... (6.3 MEDIUM)

Same CWE

  • CVE-2026-12211 — A flaw has been found in Intelbras iNVU 7016 FT 3.004.00IB000.0.T Build 2025-09-26 (2.7 LOW)
  • CVE-2026-12198 — A weakness has been identified in Microweber up to 2.0.20 (7.3 HIGH)
  • CVE-2026-12089 — The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, an... (4.9 MEDIUM)
  • CVE-2026-11442 — Allegra exportReport Directory Traversal Information Disclosure Vulnerability (6.5 MEDIUM)
  • CVE-2026-53825 — OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gatewa... (6.5 MEDIUM)