CVE-2020-5735

Amcrest cameras and network video recorders (NVRs) contain a stack-based buffer overflow (CWE-121) in the service that listens on TCP port 37777, the vendor's proprietary command/communication port. An unauthenticated, remote attacker can trigger the flaw by sending crafted data to port 37777, overflowing a stack buffer. Successful exploitation can crash the device (denial of service) and possibly allow arbitrary code execution on the camera or NVR. Any Amcrest camera or NVR whose port 37777 is reachable — especially devices port-forwarded to or directly exposed to the internet — is affected; the available data does not specify affected firmware version ranges. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, indicating confirmed in-the-wild exploitation, and its EPSS score of 36.2% (98th percentile) indicates a high near-term exploitation probability, though no public proof-of-concept is known.

What to do: Apply Amcrest firmware updates per the vendor's instructions, as required by CISA's KEV listing. Until patched, remove internet port forwards for TCP 37777 and restrict access to trusted management networks or a VPN. Check whether port 37777 is exposed on your devices and watch for unexplained crashes or reboots, which can indicate exploitation attempts.