Stack-Based Buffer Overflow in Amcrest Cameras and NVR (CVE-2020-5735) Enables Remote Code Execution
What It Is — Amcrest IP cameras and network video recorders contain a stack‑based buffer overflow in the service listening on TCP port 37777. An unauthenticated remote attacker can trigger the overflow, causing a crash and potentially executing arbitrary code.
Exploitability — The vulnerability is publicly disclosed (CVE‑2020‑5735) and can be exploited with a crafted network packet; no authentication is required. CVSS v3.1 scores 7.5 (High).
Affected Products — Amcrest consumer and professional IP cameras, and Amcrest Network Video Recorder (NVR) firmware versions prior to the vendor‑issued patch.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of IoT device configurations against defined control objectives.
- Provides evidence that a robust control‑mapping process can surface gaps before they become audit findings.
- Highlights the importance of maintaining defensible remediation records to satisfy auditors and enterprise buyers.
Recommended Actions
- Deploy Amcrest’s latest firmware that addresses CVE‑2020‑5735.
- Block inbound traffic to port 37777 at the network perimeter or restrict it to trusted management subnets.
- Segregate cameras/NVRs onto a dedicated VLAN and enforce strict access controls.
- Enable detailed logging of connection attempts and integrate logs into a SIEM for continuous evidence collection.
- Document remediation steps and retain logs as audit‑ready proof of control effectiveness.
Source: CISA KEV – CVE‑2020‑5735