← Vulnerability feed

Vulnerability record · CVE-2020-5736 · published 8 April 2020

CVE-2020-5736: Amcrest 1080-lite 8ch firmware null pointer dereference vulnerability

Amcrest · 1080 Lite 8ch Firmware

Amcrest cameras and NVR are vulnerable to a null pointer dereference over port 37777. An authenticated remote attacker can abuse this issue to crash the device.

6.5 CVSS 3.1 Medium EPSS 1.6% · top 25.4% CWE-476 · NULL pointer dereference
6.5CVSS 3.1 base score, v2 6.8
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
18Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Amcrest cameras and NVR are vulnerable to a null pointer dereference over port 37777. An authenticated remote attacker can abuse this issue to crash the device.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

18 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.tenable.com/security/research/tra-2020-20 Third Party Advisory
https://www.tenable.com/security/research/tra-2020-20 Third Party Advisory

Track CVE-2020-5736 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2020-5735Amcrest cameras and NVR stack buffer overflow on port 37777Amcrest cameras and NVR firmware contain a stack-based buffer overflow reachable over TCP port 37777. An authenticated remote attacker can send craft…KEVEPSS 36%analysed6.2CVE-2026-21525Windows Remote Access Connection Manager null pointer dereference DoSWindows Remote Access Connection Manager contains a null pointer dereference (CWE-476) that lets an unauthorized attacker deny service locally. The f…KEVEPSS 4.8%analysed

Source: NIST National Vulnerability Database (record CVE-2020-5736), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.