CVE-2020-5735: Amcrest cameras and NVR stack buffer overflow on port 37777

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a remotely reachable memory corruption issue with a CVSS of 8.8 and confirmed exploitation in CISA's KEV catalog, though it requires valid credentials.

What it is

Amcrest cameras and NVR firmware contain a stack-based buffer overflow reachable over TCP port 37777. An authenticated remote attacker can send crafted input to crash the device and potentially execute arbitrary code. Because these are network-facing surveillance devices, a compromise can expose video feeds and provide a foothold inside the network.

Impact

An attacker with valid credentials can crash the device and possibly achieve remote code execution, gaining control of the camera or NVR. That control can be used to disrupt recording, access video, or pivot further into the network.

Attack surface

The flaw is reached remotely over port 37777, the device's proprietary service port. The CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N), so any authenticated account on the device is sufficient.

Exploitation

CVE-2020-5735 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and EPSS gives a 30-day exploitation probability of about 0.36 (98th percentile). A public Packet Storm exploit reference exists, though it is tagged as a denial-of-service proof of concept.

What to do

• Apply the vendor firmware updates referenced in Amcrest's advisory and CISA's required action.
• Restrict access to TCP port 37777 to trusted management hosts only; never expose it to the internet.
• Change default and weak credentials and enforce unique, strong passwords on all camera and NVR accounts.
• Segment cameras and NVRs onto an isolated VLAN with no outbound access to the corporate network.
• Monitor vendor advisories and replace devices that no longer receive firmware support.

Detection

• Alert on repeated or malformed traffic to TCP port 37777 from unexpected sources.
• Monitor device logs and availability for unexpected reboots or crashes of cameras and NVRs.
• Watch for new or unusual outbound connections originating from camera/NVR VLANs.
• Track authentication attempts against device management interfaces for brute force or anomalous logins.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.