Skip to content
Fencer Vulns
high 8.8

CVE-2020-5735 kev in the critical feed json

Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777.

published 2020-04-08 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-26894

cvss
8.8
version 3.1, CNA
cisa kev
Exploited
added 2021-11-03
epss
36.2%
EPSS 36.2% chance of exploitation in 30 days, percentile 98%
public exploits
1
Exploit-DB

Summary

Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • amcrest ipm-721_firmware v2.420.ac00.18.r.20200217
  • amcrest ip2m-841_firmware v2.420.ac00.18.r.20200217
  • amcrest ip2m-841-v3_firmware v2.800.0000000.6.r.200314
  • amcrest ip2m-853ew_firmware v2.623.00ac004.0.r.200316
  • amcrest ip2m-858w_firmware v2.623.00ac004.0.r.200316
  • amcrest ip2m-866w_firmware v2.623.00ac004.0.r.200316
  • amcrest ip2m-866ew_firmware v2.623.00ac004.0.r.200316
  • amcrest ip4m-1053ew_firmware v2.623.00ac004.0.r.200316
  • amcrest ip8m-2454ew_firmware v2.622.00ac000.0.r.200320
  • amcrest ip8m-2493eb_firmware v2.622.00ac000.0.r.200320
  • amcrest ip8m-2496eb_firmware v2.622.00ac000.0.r.200320
  • amcrest ip8m-2597e_firmware v2.800.00ac000.0.r.200330
  • amcrest ip8m-mb2546ew_firmware v2.622.00ac000.0.r.200320
  • amcrest ip8m-mt2544ew_firmware v2.622.00ac000.0.r.200320
  • amcrest ip8m-t2499ew_firmware v2.622.00ac000.0.r.200320
  • amcrest ipm-hx1_firmware v2.420.ac00.18.r.20200217

Timeline

  1. First public exploit (EDB-48304)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
5 y ago
Patch by
2022-05-03 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Amcrest, Cameras and Network Video Recorder (NVR)
CISA name
Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1574 Hijack Execution Flow primary impact
  • T1499 Endpoint Denial of Service secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

36.22% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-48304 Amcrest Dahua NVR Camera IP2M-841 - Denial of Service (PoC) dos, 2020-04-08
  • packetstormsecurity.com http://packetstormsecurity.com/files/157164/Amcrest-Dahua-NVR-Camera-IP2M-841-Denial-Of-Service.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 8.0 AV:N/AC:L/Au:S/C:P/I:P/A:C

Affected products

  • n/a Amcrest

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.