HighCVSS 7.5
EPSS 1.9%
VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header.
Product
vivotek camera vulnerabilities
10 published CVES affecting vivotek camera, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 10
- Critical
- 2
- High
- 5
- Medium
- 3
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest vivotek camera CVEs
Newest publication first
-
-
CriticalCVSS 9.8 EPSS 1.3%
An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.
-
CriticalCVSS 9.8 EPSS 2.6%
VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header.
-
MediumCVSS 6.1 EPSS 0.80%
Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header.
-
MediumCVSS 6.1 EPSS 0.80%
Cross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter.
-
MediumCVSS 5.3 EPSS 0.93%
Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable arbitrary system services via a URL parameter.
-
HighCVSS 8.8 EPSS 3.0%
VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via eventscript.cgi.
-
HighCVSS 8.8 EPSS 3.0%
VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the ONVIF interface, (/onvif/device_service).
-
HighCVSS 8.8 EPSS 0.47%
VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.
-
HighCVSS 8.8 EPSS 2.9%
Various VIVOTEK FD8*, FD9*, FE9*, IB8*, IB9*, IP9*, IZ9*, MS9*, SD9*, and other devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.