Amcrest UltraHD 4MP PoE Camera (IP8M-2496EB)

Amcrest UltraHD 4MP PoE Camera (IP8M-2496EB)
Security Grade F Calculator v1	Amcrest UltraHD 4MP PoE Camera Brand: Amcrest (Parent: Amcrest Technologies LLC (Dahua derived firmware)) Category: Security camera • Model / Gen: UltraHD 4MP IP8M-2496EB Release Date: 2019-01-01 • Status: In sale Classification Date: 2026-10-24 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Very common	🔗 Proof	The published analysis of CVE-2017-8229 shows the researcher reaching the file system over Telnet and reading configuration from /mnt/mtd/Config, so a debug or maintenance interface is reachable on the device.
Known vulnerabilities	Very common	🔗 Proof	Eleven CVEs are recorded against the brand, including CVE-2017-8229 (CVSS 9.8, unauthenticated download of administrator credentials), CVE-2020-5735 (CVSS 8.8, stack buffer overflow on port 37777), CVE-2018-16546 (hard coded SSL private key shared across customer installations) and CVE-2019-3948 (unauthenticated access to the /videotalk audio endpoint). The firmware derives from Dahua, whose protocol stack has a recurring memory safety record.
Prior attacks	Very common	🔗 Proof	CVE-2020-5735 was added to the CISA Known Exploited Vulnerabilities catalogue on 3 November 2021 with a remediation deadline of 3 May 2022, and EPSS rates it around 36 percent at the 98th percentile, which is clear evidence of exploitation in the wild.
Updatability	Very common	🔗 Proof	Amcrest publishes firmware with explicit fixed version numbers for the reported issues and delivers updates through the support portal and the app.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	No	🔗 Proof	CVE-2019-3948 allows an unauthenticated person to reach the /videotalk endpoint and listen to device audio, while CVE-2020-7222 bypasses the web login by changing the JavaScript result parameter to true.
Communications	Encrypted with obselete encryption	🔗 Proof	CVE-2018-16546 documents the same hard coded SSL private key across different customers installations, which defeats the cryptographic protection of the management connection.
Storage	No encryption	🔗 Proof	Account files including SHA1Account1 are stored under /mnt/mtd/Config and can be downloaded over HTTP without authentication, so credentials at rest are exposed rather than encrypted.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Users are divided into admin and user groups only, and CVE-2017-8230 documents additional authorization weaknesses around those groups.
Authentication	Basic	🔗 Proof	A login exists but is bypassable by altering the client side result value, and several endpoints answer without any authentication.
Brute-force protection	Absent	🔗 Proof	Since administrator credentials can be downloaded unauthenticated, throttling or lockout provides no protection.
Event logging	Partial logging	🔗 Proof	Recording and access history exist, but no complete security audit log is documented.
Passwords	Require change after setup	🔗 Proof	A password is defined during initial configuration, but default account material remains retrievable from the device.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded Linux (Companion App: Amcrest View Pro (iOS / Android))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage: microSD up to 256 GB
Power, Battery & Charging	Battery: None • Power: Power over Ethernet (IEEE 802.3af) or 12 V DC • Charging:
Display & Camera	Display: • Camera: 4 MP (2560 x 1440), varifocal lens, infrared night vision
Sound & Connectivity	Sound: Microphone and speaker • Connectivity: Ethernet 10/100 Mbps with PoE
Physical (Dimensions & Mass)	Dimensions: approx. 160 x 100 x 100 mm • Mass: approx. 500 g

Overall assessment: This is the weakest device in the batch and the only one with confirmed exploitation in the wild. CVE-2020-5735 (CVSS 8.8, stack buffer overflow on port 37777) was added to the CISA Known Exploited Vulnerabilities catalogue on 3 November 2021 and carries an EPSS around 36 percent at the 98th percentile. Eleven CVEs are recorded against the brand, including CVE-2017-8229 (CVSS 9.8) where administrator credentials can be downloaded without any authentication from /mnt/mtd/Config, CVE-2018-16546 where the same hard coded SSL private key is shared across customer installations, which defeats transport encryption, and CVE-2019-3948 where an unauthenticated person can reach the /videotalk endpoint and listen to device audio. Login can be bypassed by altering the client side result value, so brute-force protection is meaningless when credentials are simply downloadable. Amcrest does publish firmware with explicit fixed versions, but that is the only substantial mitigating factor for a device whose firmware derives from the Dahua stack with a recurring memory safety record.