Vivotek vulnerabilities
We track 11 vulnerabilities in Vivotek products across 10 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on June 2, 2026.
Latest Vivotek vulnerabilities
- 8.8 High severity
Fd8136 Firmware: Buffer Copy without Checking Size of Input
A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. This flaw allows an authenticated attacker to execute arbitrary code as root on t
- 8.8 High severity
Fd8136 Firmware: Buffer Copy without Checking Size of Input
A post-authentication remote buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. This flaw allows an authenticated attacker to execute ar
- 9.3 Critical severity
Affected device model numbers are FD8365…: Improper Neutralization of Special Elements used in a Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE919
- 7.2 High severity
IP7137: Improper Neutralization of Special Elements used in an OS Command
Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter "system_ntpIt" used by "/cgi-bin/admin/setparam.cgi" endpoint is not sanitized properly, allowing a user with administrative privileges to perform an attack. Due to
- 9.8 Critical severity
IP7137: Use of Default Password
Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need. The vendor has not replied to th
- 7.5 High severity
IP7137: Missing Authentication for Critical Functionality
Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network ac
- 9.8 Critical severity
IB8367A: Improper Neutralization of Special Elements used in a Command
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Vivotek IB8367A VVTK-0100b. Affected is the function getenv of the file upload_file.cgi. The manipulation of the argument QUERY_STRING leads to command injection. It is po
- 9.8 Critical severity
SD9364: Improper Neutralization of Special Elements used in a Command
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been rated as critical. This issue affects the function getenv of the file upload_file.cgi. The manipulation of the argument QUERY_STRING leads to command injection.
- 9.8 Critical severity
SD9364: Improper Restriction of Operations within the Bounds of a Memory Buffer
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been declared as critical. This vulnerability affects the function read of the component httpd. The manipulation of the argument Content-Length leads to stack-based
- 9.8 Critical severity
CC8160: Improper Neutralization of Special Elements used in a Command
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d. It has been classified as critical. This affects the function getenv of the file upload_file.cgi. The manipulation of the argument QUERY_STRING leads to command injection.
- 9.8 Critical severity
CC8160: Improper Restriction of Operations within the Bounds of a Memory Buffer
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d and classified as critical. Affected by this issue is the function read of the component httpd. The manipulation of the argument Content-Length leads to stack-based buffer o