CVE-2020-5735
Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability
Description
CVE-2020-5735 is a high-severity stack-based buffer overflow vulnerability in Amcrest cameras and Network Video Recorders (NVR). The vulnerability exists on port 37777 and allows an authenticated remote attacker to crash the device and potentially execute arbitrary code. CISA has added this Amcrest vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 61.6% (98.3rd percentile), CVE-2020-5735 has a high probability of exploitation, posing a significant risk to organizations using vulnerable Amcrest surveillance equipment.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| amcrest | 1080-lite 8ch firmware | - |
| amcrest | amdv10814-h5 firmware | - |
| amcrest | ipm-721 firmware | < v2.420.ac00.18.r.20200217 |
| amcrest | ip2m-841 firmware | < v2.420.ac00.18.r.20200217 |
| amcrest | ip2m-841-v3 firmware | < v2.800.0000000.6.r.200314 |
| amcrest | ip2m-853ew firmware | < v2.623.00ac004.0.r.200316 |
| amcrest | ip2m-858w firmware | < v2.623.00ac004.0.r.200316 |
| amcrest | ip2m-866w firmware | < v2.623.00ac004.0.r.200316 |
| amcrest | ip2m-866ew firmware | < v2.623.00ac004.0.r.200316 |
| amcrest | ip4m-1053ew firmware | < v2.623.00ac004.0.r.200316 |
| amcrest | ip8m-2454ew firmware | < v2.622.00ac000.0.r.200320 |
| amcrest | ip8m-2493eb firmware | < v2.622.00ac000.0.r.200320 |
| amcrest | ip8m-2496eb firmware | < v2.622.00ac000.0.r.200320 |
| amcrest | ip8m-2597e firmware | < v2.800.00ac000.0.r.200330 |
| amcrest | ip8m-mb2546ew firmware | < v2.622.00ac000.0.r.200320 |
| amcrest | ip8m-mt2544ew firmware | < v2.622.00ac000.0.r.200320 |
| amcrest | ip8m-t2499ew firmware | < v2.622.00ac000.0.r.200320 |
| amcrest | ipm-hx1 firmware | < v2.420.ac00.18.r.20200217 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157164/Amcrest-Dahua-NVR-Camera-IP2M-841-Denial-Of-Service.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.tenable.com/security/research/tra-2020-20(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5735(US Government Resource)
Weakness Type
CWE-121: Stack-based Buffer Overflow
In Amcrest cameras and NVR devices, the stack-based buffer overflow occurs when data sent over port 37777 exceeds the allocated buffer size on the stack. The stack stores local variables and return addresses, and when the buffer overflows, attackers can overwrite adjacent stack data including saved return addresses, potentially redirecting execution to attacker-controlled code.
Learn more: CWE-121 — Stack-based Buffer Overflow
CWE-787: Out-of-bounds Write
The out-of-bounds write in Amcrest devices results from insufficient input validation on port 37777, allowing data to be written beyond the intended buffer boundaries. This memory corruption can overwrite critical control flow information and enable arbitrary code execution on the affected device.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2020-5735 carries a CVSS 3.1 score of 8.8 (HIGH), representing a significant threat to network-connected surveillance infrastructure. The vulnerability is remotely exploitable over the network with low attack complexity and requires only low-level authentication, with no user interaction needed. Successful exploitation can fully compromise confidentiality, integrity, and availability of the affected device, potentially allowing attackers to crash the camera, execute arbitrary code, or gain persistent control over the surveillance system. The EPSS score of 61.6% indicates a high likelihood of active exploitation, and as IoT devices, these cameras often lack robust monitoring and patching processes, extending the window of exposure.
Exploit Maturity
CVE-2020-5735 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available for CVE-2020-5735 via Packet Storm Security, which demonstrates the denial-of-service capability through the buffer overflow on port 37777. The EPSS score of 61.6% (98.3rd percentile) confirms a high probability of exploitation activity. The availability of public exploit code combined with the widespread deployment of Amcrest surveillance cameras makes this vulnerability particularly dangerous for organizations that have not yet applied firmware updates.
Remediation
- Apply firmware updates immediately as mandated by CISA KEV: Apply updates per vendor instructions. Amcrest has released patched firmware versions for all affected camera and NVR models.
- Update all affected Amcrest devices to their respective patched firmware versions: IP2M-841 and IPM-721 to v2.420.AC00.18.R.20200217 or later, IP2M-841-V3 to v2.800.0000000.6.R.200314 or later, IP2M-853EW/858W/866W/866EW and IP4M-1053EW to v2.623.00AC004.0.R.200316 or later, IP8M series cameras to v2.622.00AC000.0.R.200320 or later.
- Restrict network access to port 37777 using firewall rules, limiting connections only to authorized management stations and segmenting surveillance devices onto an isolated VLAN.
- Monitor network traffic to and from surveillance devices for anomalous patterns, particularly unusual data volumes on port 37777 that may indicate exploitation attempts.
- Implement network-level intrusion detection rules for buffer overflow attack signatures targeting port 37777 on Amcrest devices, and regularly audit firmware versions across all deployed cameras and NVRs.
Technical Details
CVE-2020-5735 is a stack-based buffer overflow vulnerability affecting Amcrest cameras and NVR devices through port 37777, the proprietary management protocol port. The vulnerability results from insufficient input validation when processing data received on this port, allowing an authenticated attacker to send data that exceeds the stack-allocated buffer. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that the attack is network-accessible with low complexity and requires only basic authentication. The dual CWE classification of CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write) reflects that the overflow writes data beyond the intended buffer boundaries on the stack, potentially corrupting return addresses and enabling redirection of program execution to attacker-supplied code.
Frequently Asked Questions
Is CVE-2020-5735 being actively exploited?
Yes. CVE-2020-5735 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 61.6% (98.3rd percentile) further indicates a high probability of exploitation activity against unpatched Amcrest devices.
What products are affected by CVE-2020-5735?
CVE-2020-5735 affects multiple Amcrest camera and NVR models including IP2M-841, IPM-721, IP2M-841-V3, IP2M-853EW, IP2M-858W, IP2M-866W, IP2M-866EW, IP4M-1053EW, IP8M-2454EW, IP8M-2493EB, IP8M-2496EB, IP8M-2597E, and several other models, as well as the 1080-Lite 8CH and AMDV10814-H5 NVR devices.
How do I fix CVE-2020-5735?
Apply the latest firmware updates from Amcrest for all affected camera and NVR models. Additionally, restrict network access to port 37777 using firewall rules and isolate surveillance devices on a dedicated network segment to reduce exposure.
How severe is CVE-2020-5735?
CVE-2020-5735 has a CVSS 3.1 score of 8.8 (HIGH) and an EPSS score of 61.6% (98.3rd percentile). The vulnerability allows remote code execution on surveillance devices, posing a serious risk to organizations relying on Amcrest equipment for physical security monitoring.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.