Secuno
ENNL
Book demo

CVE-2020-5735

Amcrest Cameras and NVR Stack-based Buffer Overflow

8.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 36.2%
  1. Published8 Apr 2020
  2. Added to CISA KEV3 Nov 2021
  3. Remediation due3 May 2022
Actively exploited (CISA KEV)

Amcrest cameras and NVR contain a stack-based buffer overflow vulnerability through port 37777 that allows an unauthenticated, remote attacker to crash the device and possibly execute code.

Added to KEV: 3 Nov 2021Federal remediation due: 3 May 2022

Description

Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Amcrest 1080-lite 8ch Firmwareall versions
Amcrest Amdv10814-h5 Firmwareall versions
Amcrest Ip2m-841 Firmware< v2.420.ac00.18.r.20200217
Amcrest Ip2m-841-v3 Firmware< v2.800.0000000.6.r.200314
Amcrest Ip2m-853ew Firmware< v2.623.00ac004.0.r.200316
Amcrest Ip2m-858w Firmware< v2.623.00ac004.0.r.200316
Amcrest Ip2m-866ew Firmware< v2.623.00ac004.0.r.200316
Amcrest Ip2m-866w Firmware< v2.623.00ac004.0.r.200316
Amcrest Ip4m-1053ew Firmware< v2.623.00ac004.0.r.200316
Amcrest Ip8m-2454ew Firmware< v2.622.00ac000.0.r.200320
Amcrest Ip8m-2493eb Firmware< v2.622.00ac000.0.r.200320
Amcrest Ip8m-2496eb Firmware< v2.622.00ac000.0.r.200320
Amcrest Ip8m-2597e Firmware< v2.800.00ac000.0.r.200330
Amcrest Ip8m-mb2546ew Firmware< v2.622.00ac000.0.r.200320
Amcrest Ip8m-mt2544ew Firmware< v2.622.00ac000.0.r.200320
Amcrest Ip8m-t2499ew Firmware< v2.622.00ac000.0.r.200320
Amcrest Ipm-721 Firmware< v2.420.ac00.18.r.20200217
Amcrest Ipm-hx1 Firmware< v2.420.ac00.18.r.20200217

Remediation

Fixed in
Amcrest Ip2m-841 Firmware≥ v2.420.ac00.18.r.20200217
Amcrest Ip2m-841-v3 Firmware≥ v2.800.0000000.6.r.200314
Amcrest Ip2m-853ew Firmware≥ v2.623.00ac004.0.r.200316
Amcrest Ip2m-858w Firmware≥ v2.623.00ac004.0.r.200316
Amcrest Ip2m-866ew Firmware≥ v2.623.00ac004.0.r.200316
Amcrest Ip2m-866w Firmware≥ v2.623.00ac004.0.r.200316
Amcrest Ip4m-1053ew Firmware≥ v2.623.00ac004.0.r.200316
Amcrest Ip8m-2454ew Firmware≥ v2.622.00ac000.0.r.200320
Amcrest Ip8m-2493eb Firmware≥ v2.622.00ac000.0.r.200320
Amcrest Ip8m-2496eb Firmware≥ v2.622.00ac000.0.r.200320

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-10910910.0
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability…
CVE-2026-854578.1
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to…
CVE-2026-962668.2
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability…
CVE-2026-962648.2
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability…
CVE-2026-962638.2
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,…
CVE-2026-962628.2
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability…

Frequently asked

Is CVE-2020-5735 being actively exploited?

Yes. CVE-2020-5735 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2020-5735?

CVE-2020-5735 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 36.2% probability of exploitation.

Which products are affected by CVE-2020-5735?

Affected products include Amcrest 1080-lite 8ch Firmware, Amcrest Amdv10814-h5 Firmware, Amcrest Ip2m-841 Firmware, Amcrest Ip2m-841-v3 Firmware, Amcrest Ip2m-853ew Firmware, and 13 more.

How do I fix CVE-2020-5735?

Upgrade affected software to a fixed version, for example Amcrest Ip2m-841 Firmware v2.420.ac00.18.r.20200217, Amcrest Ip2m-841-v3 Firmware v2.800.0000000.6.r.200314, Amcrest Ip2m-853ew Firmware v2.623.00ac004.0.r.200316 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-5735 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.