This vulnerability involves a stack-based buffer overflow in the export_language.cgi binary of VIVOTEK FD8136 firmware (FD8136-VVTK-0300a). An authenticated attacker can send a specially crafted POST request to the /cgi-bin/admin/export_language.cgi endpoint, where the Content-Length header is used unchecked as the size parameter in fread() to read data into a fixed-size 0x60-byte stack buffer. This leads to overwriting the saved link register, enabling arbitrary code execution with root privileges. The binary is compiled without stack canaries, which normally help prevent such exploits. There is no information on patches or mitigations from the vendor at this time.

Successful exploitation allows authenticated remote attackers to execute arbitrary code as root on the affected device. This can lead to full system compromise, including unauthorized control over the device and potential pivoting within the network. No known exploits are reported in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated access to the vulnerable endpoint and monitor for suspicious activity. Avoid exposing the device's administrative interfaces to untrusted networks.