NetSight
IP …
high8.8Known exploitedPublic exploit code

CVE-2020-5735

Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.

Affected products

VendorProductAffected versions
Amcrest1080-Lite 8ch Firmware
All versions
AmcrestAmdv10814-H5 Firmware
All versions
AmcrestIpm-721 Firmware
before v2.420.ac00.18.r.20200217
AmcrestIp2m-841 Firmware
before v2.420.ac00.18.r.20200217
AmcrestIp2m-841-V3 Firmware
before v2.800.0000000.6.r.200314
AmcrestIp2m-853ew Firmware
before v2.623.00ac004.0.r.200316
AmcrestIp2m-858w Firmware
before v2.623.00ac004.0.r.200316
AmcrestIp2m-866w Firmware
before v2.623.00ac004.0.r.200316
AmcrestIp2m-866ew Firmware
before v2.623.00ac004.0.r.200316
AmcrestIp4m-1053ew Firmware
before v2.623.00ac004.0.r.200316
AmcrestIp8m-2454ew Firmware
before v2.622.00ac000.0.r.200320
AmcrestIp8m-2493eb Firmware
before v2.622.00ac000.0.r.200320

Weakness classification

CWE-121CWE-787

References