Unauthenticated Remote Command Execution in Legacy Vivotek Devices
Command Injection
CVE ID(s):
CVE-2019-19936
Summary: https://archify-images-prod.s3.ap-southeast-1.amazonaws.com/catalog/product_files_other/4b53r-pua2f-1643099534md8563-eh-vvtk-0122a_beta2_release_note.pdf
Notified: 2025-11-02
Description:
There is an unauthenticated remote command injection in /cgi-bin/admin/eventtask.cgi that allows a user to run arbitrary commands on a vulnerable host. The only reference to this endpoint is here: https://archify-images-prod.s3.ap-southeast-1.amazonaws.com/catalog/product_files_other/4b53r-pua2f-1643099534md8563-eh-vvtk-0122a_beta2_release_note.pdf So, I believe it's a duplicate but asking vendor to confirm.
Exploit:
https://github.com/bsmithbuf/VIVOTEK_CVE_2019_19936 This will check if you're vulnerable: $ curl -v http://192.168.0.132/cgi-bin/admin/eventtask.cgi * Trying 192.168.0.132:80... * Connected to 192.168.0.132 (192.168.0.132) port 80 > GET /cgi-bin/admin/eventtask.cgi HTTP/1.1 > Host: 192.168.0.132 > User-Agent: curl/8.5.0 > Accept: */* > < HTTP/1.1 200 OK < Date: Mon, 03 Jan 2000 01:41:09 GMT < Server: Boa/0.94.14rc21 < Accept-Ranges: bytes < Connection: close < Content-type: text/plain < Missing parameter
Notes:
https://archify-images-prod.s3.ap-southeast-1.amazonaws.com/catalog/product_files_other/4b53r-pua2f-1643099534md8563-eh-vvtk-0122a_beta2_release_note.pdf