CVE-2026-30649 is a buffer overflow vulnerability (CWE-121) in the VIVOTEK INC FD8136-VVTK-0300a device. The flaw is located in the set_getparam.cgi component and can be exploited remotely without authentication to execute arbitrary code. The CVSS v3.1 base score is 7.3, indicating a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation could allow a remote attacker to execute arbitrary code on the affected device, potentially leading to confidentiality, integrity, and availability impacts. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. However, no active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor vendor communications for updates. No specific mitigation or workaround information is provided in the current data.