CVE-2020-5735: Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability

CVE-2020-5735 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2021-11-03

Executive brief

Amcrest cameras and NVR devices are vulnerable to a stack-based buffer overflow on port 37777. A remote authenticated attacker can exploit this to cause a denial-of-service (crash) or potentially execute arbitrary code on the device.

Affected products

Amcrest IP2M-841-V3 Firmware < v2.800.0000000.6.r.200314
Amcrest IP2M-841 Firmware < v2.420.ac00.18.r.20200217
Amcrest IP2M-853EW Firmware < v2.623.00ac004.0.r.200316
Amcrest IP8M-2454EW Firmware < v2.622.00ac000.0.r.200320
Amcrest IP8M-2597E Firmware < v2.800.00ac000.0.r.200330
Amcrest NVR Firmware

Timeline

2020-04-09: disclosed: Initial analysis by NIST
2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog