You do not have permission to edit this page, for the following reasons:
Overall assessment: This is the weakest device in the batch and the only one with confirmed exploitation in the wild. CVE-2020-5735 (CVSS 8.8, stack buffer overflow on port 37777) was added to the CISA Known Exploited Vulnerabilities catalogue on 3 November 2021 and carries an EPSS around 36 percent at the 98th percentile. Eleven CVEs are recorded against the brand, including CVE-2017-8229 (CVSS 9.8) where administrator credentials can be downloaded without any authentication from /mnt/mtd/Config, CVE-2018-16546 where the same hard coded SSL private key is shared across customer installations, which defeats transport encryption, and CVE-2019-3948 where an unauthenticated person can reach the /videotalk endpoint and listen to device audio. Login can be bypassed by altering the client side result value, so brute-force protection is meaningless when credentials are simply downloadable. Amcrest does publish firmware with explicit fixed versions, but that is the only substantial mitigating factor for a device whose firmware derives from the Dahua stack with a recurring memory safety record. [[Category:Classification]] [[Category:Calculator v1]] [[Category:Amcrest]]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
