CVE-2026-35717

6.3 Moyenne

Publiée le 02/06/2026 à 16:16 · Modifiée le 22/07/2026 à 21:10 · Modifiée · Source : cve@mitre.org

Description

A stack-based buffer overflow in the export_language.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request to the /cgi-bin/admin/export_language.cgi endpoint. The handler passes the attacker-controlled Content-Length value directly to fread() as the read size into a fixed-size 0x60-byte stack buffer, overwriting the saved link register. The binary is compiled without stack canaries.

Traduire en français

Produits concernés

Vivotek fd8136 firmware

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L`

Faiblesses (CWE)

CWE-121

Références

https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-35717 Third Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories