8.8Hoch
KEV
CVE-2020-5735Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability
Bekannt ausgenutzt — Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability
CISA hat am 03.11.2021 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 03.05.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-5735
Beschreibung
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| amcrest | 1080-lite 8ch firmware | — | |
| amcrest | amdv10814-h5 firmware | — | |
| amcrest | ip2m-841 firmware | < v2.420.ac00.18.r.20200217 | |
| amcrest | ip2m-841-v3 firmware | < v2.800.0000000.6.r.200314 | |
| amcrest | ip2m-853ew firmware | < v2.623.00ac004.0.r.200316 | |
| amcrest | ip2m-858w firmware | < v2.623.00ac004.0.r.200316 | |
| amcrest | ip2m-866ew firmware | < v2.623.00ac004.0.r.200316 | |
| amcrest | ip2m-866w firmware | < v2.623.00ac004.0.r.200316 | |
| amcrest | ip4m-1053ew firmware | < v2.623.00ac004.0.r.200316 | |
| amcrest | ip8m-2454ew firmware | < v2.622.00ac000.0.r.200320 | |
| amcrest | ip8m-2493eb firmware | < v2.622.00ac000.0.r.200320 | |
| amcrest | ip8m-2496eb firmware | < v2.622.00ac000.0.r.200320 | |
| amcrest | ip8m-2597e firmware | < v2.800.00ac000.0.r.200330 | |
| amcrest | ip8m-mb2546ew firmware | < v2.622.00ac000.0.r.200320 | |
| amcrest | ip8m-mt2544ew firmware | < v2.622.00ac000.0.r.200320 | |
| amcrest | ip8m-t2499ew firmware | < v2.622.00ac000.0.r.200320 | |
| amcrest | ipm-721 firmware | < v2.420.ac00.18.r.20200217 | |
| amcrest | ipm-hx1 firmware | < v2.420.ac00.18.r.20200217 | |
| — | Amcrest | before 2.623.00AC004.0.R.200316, 2.420.AC00.18.R.20200217, 2.800.00AC000.0.R.200330, 2.800.0000000.6.R.200314.bin, 2.622.00AC000.0.R.200320.bin, and 4.000.00AC000.0.R.200218 |
Referenzen und Patches
- https://www.tenable.com/security/research/tra-2020-20 Third Party Advisory
- http://packetstormsecurity.com/files/157164/Amcrest-Dahua-NVR-Camera-IP2M-841-Denial-Of-Service.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5735 US Government Resource
CPE-Treffer (NVD) (18)
cpe:2.3:o:amcrest:1080-lite_8ch_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amcrest:amdv10814-h5_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amcrest:ipm-721_firmware:*:*:*:*:*:*:*:*< v2.420.ac00.18.r.20200217cpe:2.3:o:amcrest:ip2m-841_firmware:*:*:*:*:*:*:*:*< v2.420.ac00.18.r.20200217cpe:2.3:o:amcrest:ip2m-841-v3_firmware:*:*:*:*:*:*:*:*< v2.800.0000000.6.r.200314cpe:2.3:o:amcrest:ip2m-853ew_firmware:*:*:*:*:*:*:*:*< v2.623.00ac004.0.r.200316cpe:2.3:o:amcrest:ip2m-858w_firmware:*:*:*:*:*:*:*:*< v2.623.00ac004.0.r.200316cpe:2.3:o:amcrest:ip2m-866w_firmware:*:*:*:*:*:*:*:*< v2.623.00ac004.0.r.200316cpe:2.3:o:amcrest:ip2m-866ew_firmware:*:*:*:*:*:*:*:*< v2.623.00ac004.0.r.200316cpe:2.3:o:amcrest:ip4m-1053ew_firmware:*:*:*:*:*:*:*:*< v2.623.00ac004.0.r.200316cpe:2.3:o:amcrest:ip8m-2454ew_firmware:*:*:*:*:*:*:*:*< v2.622.00ac000.0.r.200320cpe:2.3:o:amcrest:ip8m-2493eb_firmware:*:*:*:*:*:*:*:*< v2.622.00ac000.0.r.200320cpe:2.3:o:amcrest:ip8m-2496eb_firmware:*:*:*:*:*:*:*:*< v2.622.00ac000.0.r.200320cpe:2.3:o:amcrest:ip8m-2597e_firmware:*:*:*:*:*:*:*:*< v2.800.00ac000.0.r.200330cpe:2.3:o:amcrest:ip8m-mb2546ew_firmware:*:*:*:*:*:*:*:*< v2.622.00ac000.0.r.200320cpe:2.3:o:amcrest:ip8m-mt2544ew_firmware:*:*:*:*:*:*:*:*< v2.622.00ac000.0.r.200320cpe:2.3:o:amcrest:ip8m-t2499ew_firmware:*:*:*:*:*:*:*:*< v2.622.00ac000.0.r.200320cpe:2.3:o:amcrest:ipm-hx1_firmware:*:*:*:*:*:*:*:*< v2.420.ac00.18.r.20200217