CVE-2020-5735: Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability

CVE-2020-5735 is a stack-based buffer overflow in Amcrest cameras and Network Video Recorders (NVRs). An unauthenticated remote attacker who can reach the device on port 37777 may crash it and possibly execute code. Because these devices often sit on networks with camera feeds and recording storage, a successful attack can disrupt surveillance, enable further lateral movement, or give an attacker a foothold inside the environment. Confirm exact product coverage and fixed releases against the vendor advisory.

How it works

The weakness is CWE-121: a stack-based buffer overflow. The device accepts input on TCP port 37777 without adequate bounds checking. An attacker who can send crafted data to that port can overwrite memory on the stack. Overwriting the stack can crash the process (denial of service) and, under the right conditions, may allow the attacker to redirect execution and run arbitrary code with the privileges of the vulnerable service. No authentication is required. Specific packet formats and offsets are not detailed here; treat any unauthenticated reachability to port 37777 on Amcrest cameras or NVRs as high risk until the vendor update is applied and verified.

Am I affected? How to find it in your systems

Amcrest cameras and NVRs are commonly deployed for physical security monitoring—on corporate LANs, in branch offices, warehouses, and sometimes on internet-facing segments or via port forwarding. Inventory steps:

• Query asset management, network discovery, or camera management platforms for Amcrest-branded devices and any rebranded units that share the same firmware lineage.
• Scan internal and perimeter networks for hosts listening on TCP 37777; correlate results with MAC OUI, HTTP banners, RTSP, or vendor management ports to identify Amcrest gear.
• Check device web UIs or management consoles for model and firmware version strings, then compare them to the fixed versions listed in the vendor advisory. Do not rely on assumed version ranges.
• Review firewall and NAT rules for any intentional or accidental exposure of port 37777 to untrusted networks.

Telemetry signs of exploitation attempts include sudden device reboots or service crashes, unexpected traffic spikes or malformed packets destined to port 37777 from external or unusual internal sources, and new outbound connections originating from the camera/NVR after such traffic. Capture and retain packet samples if you observe anomalies; correlate with authentication and management logs on the device if available.

How to remediate

Patch first. Apply the updates published by Amcrest for the affected cameras and NVRs exactly as described in the vendor advisory and follow CISA’s direction to apply updates per vendor instructions. After upgrading:

• Verify the new firmware version on each device and confirm port 37777 behavior matches the post-patch expectation.
• Remove any unnecessary internet or wide-area exposure of management and media ports; place cameras and NVRs on segmented VLANs with strict allow-lists.
• Disable unused services and change default credentials; enforce unique, strong passwords and, where supported, certificate-based or centralized authentication.
• Ensure devices receive ongoing firmware maintenance and are included in regular vulnerability scanning and configuration baselines.

If you can't patch immediately

Reduce exposure until the vendor update can be installed:

• Block or restrict TCP 37777 at network boundaries and internal segmentation points so only trusted management hosts can reach it.
• If a web application firewall or IPS is in path, enable or tune signatures that detect buffer-overflow style payloads or anomalous traffic to Amcrest management ports; treat this as temporary virtual patching only.
• Disable remote access features that are not required for operations; prefer out-of-band or jump-host access for administration.
• Increase monitoring: alert on crashes, reboots, and any traffic to or from port 37777 that deviates from established baselines. Isolate any device that shows signs of compromise pending forensic review and rebuild.

If your data may have been exposed

Actively exploited remote-code-execution flaws on network appliances can lead to full device compromise, credential theft, and lateral movement into broader systems that store or process sensitive data. If you suspect exploitation, isolate affected units, preserve logs and disk images, rotate credentials that may have been present on or accessible from the device, and follow your incident-response plan. You can also run a free exposure scan of your email addresses against known breach data sets to check whether associated accounts have appeared in prior incidents.