This vulnerability involves a stack-based buffer overflow in the motion_privacy.cgi binary within VIVOTEK FD8136 firmware (FD8136-VVTK-0300a). Authenticated attackers can send a POST request with an oversized 'n1' parameter to the /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profile.cgi endpoints, which are symlinks to the same binary. The oversized parameter is copied into a fixed-size 0xa4-byte stack buffer without bounds checking, overwriting the saved link register and enabling arbitrary code execution with root privileges. The binary is compiled without stack canaries, increasing exploitability. There is no CVSS score or vendor advisory indicating patch availability or mitigation.

Successful exploitation allows authenticated remote attackers to execute arbitrary code with root privileges on affected devices. This can lead to full compromise of the device, including unauthorized control and potential disruption of device functionality. No known exploits in the wild have been reported, and no patch or mitigation guidance is currently available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated access to the affected endpoints and monitor for suspicious activity. Avoid exposing the vulnerable CGI endpoints to untrusted networks. No vendor advisory or official mitigation instructions are currently available.