CVE-2020-5735

What Are Amcrest Cameras and NVRs?

Amcrest is a consumer and small-business security camera and network video recorder (NVR) brand whose product line is built on hardware and firmware licensed from Dahua, a major Chinese surveillance equipment manufacturer — meaning many Amcrest devices share underlying protocol implementations with Dahua-branded cameras sold globally. Port 37777 is a proprietary Dahua/Amcrest device-management protocol used for remote configuration and video streaming, exposed by default on many deployments.

Overview

CVE-2020-5735 is a stack-based buffer overflow vulnerability (CWE-121) in Amcrest cameras and NVRs, reachable through the port 37777 management protocol. An unauthenticated remote attacker can send a crafted request that overflows a stack buffer, crashing the device and potentially achieving code execution (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High).

Technical Details

The proprietary port 37777 protocol handler fails to properly bound-check certain fields in incoming requests, allowing a crafted packet to overflow a stack-allocated buffer. Depending on the specifics of the overflow and the device's memory layout protections, this can range from a denial-of-service crash to full remote code execution.

Discovery

Publicly tracked via NVD; consistent with a broader pattern of vulnerabilities found in Dahua-derived camera/NVR firmware, which has had a recurring history of memory-safety issues across multiple rebranded product lines.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. Security cameras and NVRs are attractive IoT botnet targets given their always-on internet connectivity (often for remote viewing) and typically weak patch discipline among end users, making this class of vulnerability a recurring target for recruitment into DDoS and proxy botnets.

Remediation

1. Update Amcrest camera/NVR firmware to the version that addresses this vulnerability, available through Amcrest's support portal.
2. Restrict port 37777 exposure — this management protocol should not be directly reachable from the internet; use a VPN for remote access instead of port-forwarding.
3. Segment IoT camera/NVR devices onto a separate network from other business or home systems, limiting the blast radius if a device is compromised.
4. Check for signs of compromise — unexpected reboots, unfamiliar outbound connections, or degraded performance — on any device that has had port 37777 internet-exposed.