Amcrest and Dahua IP Camera/NVR Stack-based Buffer Overflow Vulnerability (CVE-2020-5735) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAmcrest and Dahua IP cameras and NVR devices with TCP port 37777 enabled
Authenticated remote attackers can exploit this vulnerability to crash the device (DoS) or potentially execute arbitrary code (RCE)
Apply the latest firmware updates immediately and restrict access to TCP port 37777 using firewalls
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Download and apply the latest firmware from the official Amcrest support portal. For automated environments, firmware upgrades can be initiated via the device API:
# Example API call to trigger firmware upgrade (requires valid credentials)
curl -u 'admin:your_password' -X POST 'http://<DEVICE_IP>/cgi-bin/upgrade.cgi?action=start'2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to TCP port 37777 using network firewalls or local iptables rules to allow only authorized management stations.
# Block external access to port 37777 and allow only trusted subnet (192.168.1.0/24)
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 37777 -j ACCEPT
iptables -A INPUT -p tcp --dport 37777 -j DROP3. Log Audit & IoC Verification Commands
Verify if the vulnerable port 37777 is exposed on your network using the following scanning command:
# Check if port 37777 is open on the target device
nc -z -v -w5 <DEVICE_IP> 37777Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-5735) is a stack-based buffer overflow (CWE-121) in Amcrest and Dahua IP cameras and NVR (Network Video Recorder) devices listening on TCP port 37777. The root cause lies in the lack of proper bounds checking on input data within the communication protocol handler, leading to memory corruption (CWE-787) when copying data into a fixed-size stack buffer.
2. Exploitation Mechanics & Attack Scenario
An authenticated remote attacker can exploit this vulnerability by sending crafted, oversized packets to the target device over TCP port 37777. Because the input length is not validated, the payload overwrites the stack memory, including the return address. This allows the attacker to hijack the control flow, leading to a device crash (Denial of Service) or potential execution of arbitrary shellcode with system privileges.
3. Infrastructure & Business Impact
As this vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, it represents a high-risk threat with active exploitation history. Successful exploitation can disable physical security monitoring systems (CCTV) or allow attackers to use compromised IoT devices as a pivot point to compromise the internal corporate network.
Official Vendor Advisories & References
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.
Frequently Asked SecOps Questions (CVE-2020-5735)
FAQQ1. How critical is CVE-2020-5735 and is it actively exploited in the wild?
CVE-2020-5735 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 36.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-5735?
Primary impacted vendors include amcrest, dahua across ip2m-841, nvr, camera. Scope summary: Amcrest IP cameras (including IP2M-841) and NVR devices running legacy firmware with TCP port 37777 exposed
Q3. What temporary mitigations or workarounds exist for CVE-2020-5735 before patching?
[Mitigation] Apply the latest firmware updates immediately and restrict access to TCP port 37777 using firewalls Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-5735
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (amcrest)
View Category →Palo Alto Networks PAN-OS User-ID Authentication Portal Buffer Overflow RCE Vulnerability (CVE-2026-0300)
[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.
Zyxel GS1900 Series Switch CGI Stack-based Buffer Overflow Remote Code Execution (RCE) Advisory (CVE-2026-7273)
[Affected Scope] Zyxel GS1900-48HPv2 firmware versions up to 2.90(ABTQ.1)C0.
DD-WRT UPnP SSDP Buffer Overflow Vulnerability (CVE-2021-27137) Analysis and Mitigation Guide
[Affected Scope] DD-WRT firmware versions before build 45724 with UPnP functionality enabled
D-Link DIR-505 Router TFTP File Upload Stack-Based Buffer Overflow (CVE-2026-120189) Technical Analysis and Mitigation Guide
[Affected Scope] D-Link DIR-505 firmware version 1.10B02 and prior
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.