CVE-2024-26548

CRITICAL
Published Feb 29, 2024 Modified May 13, 2025

Description

An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the upload_file.cgi component.

Is your site exposed to CVE-2024-26548?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor Product
vivotek camera_firmware
vivotek camera

References

Frequently Asked Questions

What is CVE-2024-26548? +
An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the upload_file.cgi component. It has a CVSS v3.1 base score of 9.8 (CRITICAL).
How severe is CVE-2024-26548? +
CVE-2024-26548 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.
What products are affected by CVE-2024-26548? +
CVE-2024-26548 affects products from vivotek, specifically: camera, camera_firmware. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-26548? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-30652 8.8

A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware …
CVE-2026-30650 8.8

A post-authentication remote buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask.cgi endpoint of the admin interface of Vivotek FD8136 cameras running …
CVE-2024-7439 8.8

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d and classified as critical. Affected by this …
CVE-2024-7441 8.8

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been declared as critical. This …
CVE-2026-30649 7.3

Buffer Overflow vulnerability in VIVOTEK INC FD8136-VVTK-0300a allows a remote attacker to execute arbitrary code via the set_getparam.cgi component
CVE-2026-35718 6.5

A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated attackers to read any …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-26548 — free, no signup required.