Amcrest Camera/NVR Multiple Vulnerabilities

Tenable has discovered a couple of vulnerabilities in the port 37777 interface found on a variety of Amcrest/Dahua IP camera and NVR devices. Initially, we verified these vulnerabilities to be present on the Amcrest IP2M-841 and Amcrest 1080-Lite 8CH, and Amcrest verified the issue on a number of their other products. We also assume the vulnerabilities are present among other Dahua developed devices.

CVE-2020-5735: Remote Authenticated Stack Buffer Overflow

A remote authenticated attacker can send a crafted message to port 37777 and overflow a stack-based buffer. Specifically, using command 0x62 with subcommand 0x04 invoke DDNS testing logic within the device. When providing the DDNS testing logic with a large Protocol field value a memcpy() will write beyond the bounds of a stack buffer. At the very least, the resulting crash force the camera to reboot. We also believe that this could be used to execute arbitrary code.

We've created a proof of concept that reproduces the crash. You can find it on our GitHub.

CVE-2020-5736: Remote Authenticated Null Ptr Dereference

A remote authenticated attacker can send a crafted message to port 37777 and crash the device. Specifically, invoking command 0xa2 to reach the log search functionality and providing a payload length of 0 results in the crash due to a NULL pointer dereference

We've created a proof of concept that reproduces the crash. You can find it on our GitHub.

Brute forcing over port 37777

Amcrest / Dahua have taken steps to ensure that login brute force attacks cannot take place over the HTTP interface. For example, the NVR under test only allows 10 login attempts and the camera under test allows 30 attempts. However, there is no restriction on the number of login attempts over port 37777 despite using the same credentials. Furthemore, this interface offers all the administrative capabilities and video/audio streaming offered by the HTTP interface. The only thing preventing brute force attacks on port 37777 is a proprietary login algorithm which we have obviously have implemented in our PoC.

As such, we suggest user's not expose this port to the internet. However we observe that Shodan has flagged ~1.3 million hosts exposing this interface.