Remote Code Execution Vulnerability in Vivotek FD8136 Devices

CVE-2018-14496

What is CVE-2018-14496?

Vivotek FD8136 devices are susceptible to a buffer overflow vulnerability that allows for remote memory corruption and potential remote code execution. This issue arises from improper handling of data in the sprintf function, particularly with the variable vlocal_buff_4326 in the set_getparam.cgi script. Although the vendor disputes this issue as a vulnerability, asserting that it does not affect web server stability or performance, the nature of the flaw raises significant security concerns, especially in an IoT context.

References