CVE-2026-35716
Possible ATT&CK Techniques 2AI
T1190 · Exploit Public-Facing Application T1203 · Exploitation for Client ExecutionGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-35716
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
A stack-based buffer overflow in the motion_privacy.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via an oversized n1 parameter in a POST request to the /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profile.cgi endpoint (all symlinks to the same binary). The parameter value is copied into a fixed-size 0xa4-byte stack buffer without bounds checking, overwriting the saved link register. The binary is compiled without stack canaries.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2026-35716
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-35716
请登录查看更多情报信息。
Proof of Concept for CVE-2026-35716 (1)
Vendor Pages for CVE-2026-35716 (1)
Same Patch Batch · n/a · 2026-06-02 · 16 CVEs total
| CVE-2026-10608 | 7.3 HIGH | DedeCMS carbuyaction.php RemoveXSS sql injection |
| CVE-2026-10607 | 7.3 HIGH | DedeCMS flink.php dede_htmlspecialchars sql injection |
| CVE-2026-10606 | 7.3 HIGH | DedeCMS Feedback feedback.php TrimMsg sql injection |
| CVE-2026-10581 | 6.3 MEDIUM | DedeCMS download.php base64_decode server-side request forgery |
| CVE-2026-10565 | 3.1 LOW | Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition |
| CVE-2026-35717 | VIVOTEK FD8136栈溢出漏洞 | |
| CVE-2026-35718 | VIVOTEK FD8136-VVTK 0300a路径遍历漏洞 | |
| CVE-2026-38978 | Transmission 4.1.1 WebUI/RPC 点击劫持漏洞 | |
| CVE-2026-30652 | Vivotek FD8136固件远程缓冲区溢出漏洞 | |
| CVE-2026-30649 | VIVOTEK FD8136-VVTK-0300a CGI缓冲区溢出导致任意代码执行 | |
| CVE-2026-30650 | Vivotek FD8136 VVTK-0300a远程代码执行漏洞 | |
| CVE-2026-48682 | FastNetMon 1.2.9 IPv4解析越界读取漏洞 | |
| CVE-2026-38967 | Crow HTTP响应头注入漏洞（v1.3.1及以下） | |
| CVE-2026-30586 | Memos v0.26.0 存储型跨站脚本漏洞 | |
| CVE-2026-33553 | CFEngine Enterprise 3.24.x/3.27.x跨站脚本漏洞 |
IV. Related Vulnerabilities
Same vendor: n/a
- CVE-2026-10608
DedeCMS carbuyaction.php RemoveXSS sql injection - CVE-2026-10607
DedeCMS flink.php dede_htmlspecialchars sql injection - CVE-2026-10606
DedeCMS Feedback feedback.php TrimMsg sql injection - CVE-2026-10581
DedeCMS download.php base64_decode server-side request forge - CVE-2026-10565
Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race
V. Comments for CVE-2026-35716
No comments yet