Vivotek

26 CVEs across 441 Vivotek products. Browse Vivotek vulnerabilities, severities, and proof-of-concept exploits.

Vivotek products with known CVEs

ProductCVEs
Camera11
Fd81369
Fd8136 Firmware9
Pt71355
Pt7135 Firmware5
Cc81604
Cc8160 Firmware4
Ip71374
Ip7137 Firmware4
Ib8367a3
Ib8367a Firmware3
Cc8160\(hs\)2
Cc8160\(hs\) Firmware2
Cc8370-Hv2
Cc8370-Hv Firmware2
Cc8371-Hv2
Cc8371-Hv Firmware2
Cc9381-Hv2
Cc9381-Hv Firmware2
Cd8371-Hntv2
Cd8371-Hntv Firmware2
Cd8371-Hnvf22
Cd8371-Hnvf2 Firmware2
Fd8166a2
Fd8166a Firmware2
Fd8166a-N2
Fd8166a-N Firmware2
Fd8167a2
Fd8167a Firmware2
Fd8169a2
Fd8169a Firmware2
Fd816ba-Hf22
Fd816ba-Hf2 Firmware2
Fd816ba-Ht2
Fd816ba-Ht Firmware2
Fd816b-Hf22
Fd816b-Hf2 Firmware2
Fd816b-Ht2
Fd816b-Ht Firmware2
Fd816ca-Hf22
Fd816ca-Hf2 Firmware2
Fd816c-Hf22
Fd816c-Hf2 Firmware2
Fd8177-H2
Fd8177-H Firmware2
Fd8177-Ht2
Fd8177-Ht Firmware2
Fd8179-H2
Fd8179-H Firmware2
Fd8182-F12
Vivotek CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-35718Medium6.52026-06-02A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated attackers to read any f…
CVE-2026-35716Medium6.32026-06-02A stack-based buffer overflow in the motion_privacy.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute ar…
CVE-2026-30652High8.82026-06-02A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version…
CVE-2026-30650High8.82026-06-02A post-authentication remote buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask.cgi endpoint of the admin interface of Vivotek FD8136 cameras…
CVE-2026-30649High7.32026-06-02Buffer Overflow vulnerability in VIVOTEK INC FD8136-VVTK-0300a allows a remote attacker to execute arbitrary code via the set_getparam.cgi component
CVE-2026-35717Medium6.32026-06-02A stack-based buffer overflow in the export_language.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute a…
CVE-2026-227552026-01-13Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2…
CVE-2025-66052High7.22026-01-09Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter "system_ntpIt" used by "/cgi-bin/admin/setparam.cgi" endpoint i…
CVE-2025-66051Medium6.52026-01-09Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated attacker to access resources beyond webr…
CVE-2025-66050Critical9.82026-01-09Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible…
CVE-2025-66049High7.52026-01-09Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP p…
CVE-2025-125922025-11-19Legacy Vivotek Device firmware uses default credetials for the root and user login accounts.
CVE-2025-3403Low2.72025-04-08A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is…
CVE-2024-7443Medium6.32024-08-03** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Vivotek IB8367A VVTK-0100b. Affected is the function getenv of the fil…
CVE-2024-7442Medium6.32024-08-03** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been rated as critical. This issue affects the function getenv o…
CVE-2024-7441High8.82024-08-03** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been declared as critical. This vulnerability affects the functi…
CVE-2024-7440Medium6.32024-08-03** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d. It has been classified as critical. This affects the function getenv of…
CVE-2024-7439High8.82024-08-03** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d and classified as critical. Affected by this issue is the function read…
CVE-2024-26548Critical9.82024-02-29An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the upload_file.cgi compone…
CVE-2020-11950High8.82020-05-28VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execute a script (with r…
CVE-2020-11949Medium6.52020-05-28testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user t…
CVE-2013-1598High8.82020-01-24A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold l…
CVE-2013-1597Medium6.52020-01-24A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET request, which could let a malicious user o…
CVE-2013-1596Medium5.32020-01-24An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554.
CVE-2013-1595Critical9.82020-01-24A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization header field sent to the…
CVE-2013-1594High7.52020-01-24An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wireless keys and 3rd party credentials sto…
CVE-2013-4985High7.52019-12-27Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream
CVE-2019-14458High7.52019-09-18VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header.
CVE-2019-10256Critical9.82019-09-10An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.
CVE-2019-14457Critical9.82019-09-10VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header.
CVE-2018-14496Critical9.82019-07-10Vivotek FD8136 devices allow remote memory corruption and remote code execution because of a stack-based buffer overflow, related to sprintf, vlocal_buff_4326…
CVE-2018-14495Critical9.82019-07-10Vivotek FD8136 devices allow Remote Command Injection, aka "another command injection vulnerability in our target device," a different issue than CVE-2018-1449…
CVE-2018-14494Critical9.82019-07-10Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget. NOTE: the vendor sent a clarification on 2019-09-17 explaining that, althou…
CVE-2018-18244Medium6.12019-01-03Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScr…
CVE-2018-18005Medium6.12019-01-03Cross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary Jav…
CVE-2018-18004Medium5.32019-01-03Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable ar…
CVE-2018-14771High8.82018-09-05VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via eventscript.cgi.
CVE-2018-14770High8.82018-09-05VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the ONVIF interface, (/onvif/device_service…
CVE-2018-14769High8.82018-09-05VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.
CVE-2018-14768High8.82018-08-29Various VIVOTEK FD8*, FD9*, FE9*, IB8*, IB9*, IP9*, IZ9*, MS9*, SD9*, and other devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary co…
CVE-2017-9829High7.52017-06-23'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on…
CVE-2017-9828Critical9.82017-06-23'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attacke…
CVE-2008-47712008-10-28Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll 1.0.0.27 and 1.0.0.51), (2) D-Link MPEG4 SHM Audi…
CVE-2007-31672007-06-11Stack-based buffer overflow in the Vivotek Motion Jpeg ActiveX control (aka MjpegControl) in MjpegDecoder.dll 2.0.0.13 allows remote attackers to execute arbit…