fkie_cve-2020-5735
Vulnerability from fkie_nvd
Published
2020-04-08 13:15
Modified
2025-02-06 21:15
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.
References
vulnreport@tenable.comhttp://packetstormsecurity.com/files/157164/Amcrest-Dahua-NVR-Camera-IP2M-841-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
vulnreport@tenable.comhttps://www.tenable.com/security/research/tra-2020-20Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/157164/Amcrest-Dahua-NVR-Camera-IP2M-841-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/research/tra-2020-20Third Party Advisory
Impacted products
Vendor Product Version
amcrest 1080-lite_8ch_firmware -
amcrest 1080-lite_8ch -
amcrest amdv10814-h5_firmware -
amcrest amdv10814-h5 -
amcrest ipm-721_firmware *
amcrest ipm-721 -
amcrest ip2m-841_firmware *
amcrest ip2m-841 -
amcrest ip2m-841-v3_firmware *
amcrest ip2m-841-v3 -
amcrest ip2m-853ew_firmware *
amcrest ip2m-853ew -
amcrest ip2m-858w_firmware *
amcrest ip2m-858w -
amcrest ip2m-866w_firmware *
amcrest ip2m-866w -
amcrest ip2m-866ew_firmware *
amcrest ip2m-866ew -
amcrest ip4m-1053ew_firmware *
amcrest ip4m-1053ew -
amcrest ip8m-2454ew_firmware *
amcrest ip8m-2454ew -
amcrest ip8m-2493eb_firmware *
amcrest ip8m-2493eb -
amcrest ip8m-2496eb_firmware *
amcrest ip8m-2496eb -
amcrest ip8m-2597e_firmware *
amcrest ip8m-2597e -
amcrest ip8m-mb2546ew_firmware *
amcrest ip8m-mb2546ew -
amcrest ip8m-mt2544ew_firmware *
amcrest ip8m-mt2544ew -
amcrest ip8m-t2499ew_firmware *
amcrest ip8m-t2499ew -
amcrest ipm-hx1_firmware *
amcrest ipm-hx1 -


To clipboard 

{
  "cisaActionDue": "2022-05-03",
  "cisaExploitAdd": "2021-11-03",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:1080-lite_8ch_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C61F452-2A51-46FF-B1C7-34945F492A39",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:1080-lite_8ch:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2D16F02-8C16-49B9-BE44-E2B276B7ADDF",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:amdv10814-h5_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8405ED1F-4BEF-4C33-B4F8-4AD1158AA4AE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:amdv10814-h5:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "32E848D9-DA23-414C-AA10-433DC2EF5E92",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ipm-721_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FFD970B-1C63-4A0A-8E2A-1F827E40C01C",
              "versionEndExcluding": "v2.420.ac00.18.r.20200217",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ipm-721:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5E5E186-BB77-4521-9899-5A3A67A3B605",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip2m-841_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A902EBE-0AEB-4B61-9642-5A5432C0717B",
              "versionEndExcluding": "v2.420.ac00.18.r.20200217",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip2m-841:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7FAE4629-638C-4E75-BBCD-6BBC78CEB209",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip2m-841-v3_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "81ABAC27-E7F0-47AA-B230-F62D3732E5AA",
              "versionEndExcluding": "v2.800.0000000.6.r.200314",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip2m-841-v3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F923CD3E-2D9B-4F90-A5CB-B1ACCE434796",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip2m-853ew_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF9698AB-1ADF-4920-966F-9D0FE4387FEB",
              "versionEndExcluding": "v2.623.00ac004.0.r.200316",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip2m-853ew:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D58539B-B2B7-4591-9E62-7D975E1367A4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip2m-858w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E9D4714-C59D-4EA2-83F7-6DCF0DF4D6C4",
              "versionEndExcluding": "v2.623.00ac004.0.r.200316",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip2m-858w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEB6D0A5-801D-4A24-A929-29E56946FB06",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip2m-866w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "63C7AD48-C6E0-4795-BBCF-A94C29C6C750",
              "versionEndExcluding": "v2.623.00ac004.0.r.200316",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip2m-866w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFB419C8-24DD-4675-B307-8BD1EABA4137",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip2m-866ew_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A76D0DD5-EF2B-4C1E-8C55-7C4B901CB3C7",
              "versionEndExcluding": "v2.623.00ac004.0.r.200316",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip2m-866ew:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1174F83A-9E21-4E58-9401-BBECE7DA120A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip4m-1053ew_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "03AC3809-D4F7-4389-81D1-B0974607E399",
              "versionEndExcluding": "v2.623.00ac004.0.r.200316",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip4m-1053ew:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D253678-7AE4-44E9-AC36-767E19095606",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip8m-2454ew_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3CC4801F-97BE-4C54-9446-DC334720B80E",
              "versionEndExcluding": "v2.622.00ac000.0.r.200320",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip8m-2454ew:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F78A7E0-4AB1-4368-AD5C-F1BFCACAA24F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip8m-2493eb_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D702C27-7E71-4BBC-A87B-F8E332A47BB4",
              "versionEndExcluding": "v2.622.00ac000.0.r.200320",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip8m-2493eb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "758995EB-21E0-4DD1-BC5E-AB4ED77DF2EC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip8m-2496eb_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "90210F99-5625-4E70-9EEB-747B7B698CA7",
              "versionEndExcluding": "v2.622.00ac000.0.r.200320",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip8m-2496eb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "16FC4DDB-806B-45C7-A8DB-12ACF6A49FA5",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip8m-2597e_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5E9C32A-0925-4C9C-AB8E-8AC0B7179AE1",
              "versionEndExcluding": "v2.800.00ac000.0.r.200330",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip8m-2597e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24A50ACA-1C8E-4519-AAFC-CF23953423F8",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip8m-mb2546ew_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEE8B1B3-FFA7-4229-864C-7965FCE10D2D",
              "versionEndExcluding": "v2.622.00ac000.0.r.200320",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip8m-mb2546ew:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BDADA94-DADA-4B7E-9351-FE942FE431B1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip8m-mt2544ew_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "970C91C0-0AEC-4716-A281-1EF3DF11E203",
              "versionEndExcluding": "v2.622.00ac000.0.r.200320",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip8m-mt2544ew:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E26CDFAC-37C3-48EA-95B8-9FBDF1B2922A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ip8m-t2499ew_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2B6B969-4F59-4C67-8AF3-9282E3AAE2C4",
              "versionEndExcluding": "v2.622.00ac000.0.r.200320",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ip8m-t2499ew:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C033CF24-B639-47C0-8BEA-5BAB33D16ACF",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amcrest:ipm-hx1_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "342225EB-DE54-436E-9589-42593B9179E1",
              "versionEndExcluding": "v2.420.ac00.18.r.20200217",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amcrest:ipm-hx1:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D32B1CE-209B-4BCF-A159-0979EB61E766",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Las c\u00e1maras y NVR Amcrest , son vulnerables a un desbordamiento del b\u00fafer en la regi\u00f3n stack de la memoria sobre el puerto 37777. Un atacante remoto autenticado puede abusar de este problema para bloquear el dispositivo y posiblemente ejecutar c\u00f3digo arbitrario."
    }
  ],
  "id": "CVE-2020-5735",
  "lastModified": "2025-02-06T21:15:15.593",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 8.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 8.5,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2020-04-08T13:15:13.003",
  "references": [
    {
      "source": "vulnreport@tenable.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/157164/Amcrest-Dahua-NVR-Camera-IP2M-841-Denial-Of-Service.html"
    },
    {
      "source": "vulnreport@tenable.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.tenable.com/security/research/tra-2020-20"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/157164/Amcrest-Dahua-NVR-Camera-IP2M-841-Denial-Of-Service.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.tenable.com/security/research/tra-2020-20"
    }
  ],
  "sourceIdentifier": "vulnreport@tenable.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ],
      "source": "vulnreport@tenable.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.