CVE-2026-35716 describes a stack-based buffer overflow in the motion_privacy.cgi binary within VIVOTEK FD8136 firmware (FD8136-VVTK-0300a). Authenticated attackers can send a POST request with an oversized n1 parameter to /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profile.cgi (all symlinks to the same binary). The parameter is copied into a fixed-size 0xa4-byte stack buffer without bounds checking, overwriting the saved link register. The binary is compiled without stack canaries, increasing the risk of arbitrary code execution as root.

Successful exploitation allows authenticated remote attackers to execute arbitrary code with root privileges on the affected device. This can lead to full compromise of the device, including potential disruption of services, unauthorized access, and control over device functions. The CVSS score of 6.3 reflects a medium severity with network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or vendor advisory has been provided at this time. Until a patch is available, restrict access to the affected CGI endpoints to trusted users only and monitor for suspicious activity involving these endpoints. Avoid exposing the device management interfaces to untrusted networks.