Vivotek vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-30652 A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version High 8.8 · Jun 2, 2026
• CVE-2026-30650 A post-authentication remote buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask.cgi endpoint of the admin interface of Vivotek FD8136 cameras High 8.8 · Jun 2, 2026
• CVE-2026-30649 Buffer Overflow vulnerability in VIVOTEK INC FD8136-VVTK-0300a allows a remote attacker to execute arbitrary code via the set_getparam.cgi componentHigh 7.3 · Jun 2, 2026
• CVE-2026-22755 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2,Critical 9.3 · Jan 13, 2026
• CVE-2025-66052 Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection.High 8.6 · Jan 9, 2026
• CVE-2025-66050 Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator.Critical 9.3 · Jan 9, 2026
• CVE-2025-66049 Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP prHigh 8.7 · Jan 9, 2026
• CVE-2025-12592 Legacy Vivotek Device firmware uses default credetials for the root and user login accounts.Critical 9.3 · Nov 19, 2025
• CVE-2024-7441 ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f.High 8.7 · Aug 3, 2024
• CVE-2024-7439 ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d and classified as critical.High 8.7 · Aug 3, 2024
• CVE-2024-26548 An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the upload_file.cgi componenCritical 9.8 · Feb 29, 2024
• CVE-2020-11950 VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execute a script (with reHigh 8.8 · May 28, 2020
• CVE-2013-1598 A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold leHigh 8.8 · Jan 24, 2020
• CVE-2013-1595 A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization header field sent to the Critical 9.8 · Jan 24, 2020
• CVE-2013-1594 An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wireless keys and 3rd party credentials storHigh 7.5 · Jan 24, 2020
• CVE-2013-4985 Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video streamHigh 7.5 · Dec 27, 2019
• CVE-2019-14458 VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header.High 7.5 · Sep 18, 2019
• CVE-2019-10256 An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.Critical 9.8 · Sep 10, 2019
• CVE-2019-14457 VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header.Critical 9.8 · Sep 10, 2019
• CVE-2018-14496 Vivotek FD8136 devices allow remote memory corruption and remote code execution because of a stack-based buffer overflow, related to sprintf, vlocal_buff_4326, Critical 9.8 · Jul 10, 2019
• CVE-2018-14495 Vivotek FD8136 devices allow Remote Command Injection, aka "another command injection vulnerability in our target device," a different issue than CVE-2018-14494Critical 9.8 · Jul 10, 2019
• CVE-2018-14494 Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget.Critical 9.8 · Jul 10, 2019
• CVE-2018-14771 VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via eventscript.cgi.High 8.8 · Sep 5, 2018
• CVE-2018-14770 VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the ONVIF interface, (/onvif/device_service)High 8.8 · Sep 5, 2018
• CVE-2018-14769 VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.High 8.8 · Sep 5, 2018