CVE-2020-36885 is a critical (CVSS 9.8) stack buffer overflow in the ftpclient.cgi endpoint of Sony IPELA network cameras, listed for the SNC-DH120T. VulnCheck gives the affected range as firmware before 1.88.00. Update to 1.88.00 or later and keep cameras off the internet.
What's affected
Sony IPELA Network Camera firmware, with version 1.82.01 named in the record and the SNC-DH120T listed as the product. VulnCheck's advisory gives the affected range as firmware before v1.88.00.
The record says the flaw is in the ftpclient.cgi endpoint and is reached by a crafted POST request with oversized data to the FTP client feature, and that it can cause remote code execution or denial of service.
Sony's support pages for the product were not reachable from my tools, so confirm the fixed version on Sony's SNC-DH120 support page before you rely on the number.
How to check if you're exposed
Open the camera's web interface and read the firmware version on the system or information page. Anything below 1.88.00 is in scope according to VulnCheck.
Then check who can reach the camera:
nmap -sV -p 80,443 <camera-address>
Cameras should be on a dedicated network segment. Check that no router forwards a port to the camera, and check whether the camera has a cloud or relay feature that publishes it.
Review whether any camera sits on the same network as business systems. If so, plan a move to a separate segment.
What to do now
- List all Sony IPELA cameras and their firmware versions.
- Update to 1.88.00 or later, after confirming the version on the Sony support page.
- Put cameras on a separate network segment and block their access to the internet unless it is required.
- Remove any port forwarding to cameras.
- Change default credentials and restrict the camera admin interface to a management host.
Why it matters
The class is CWE-787 (Out-of-bounds Write). A web handler that processes the FTP client settings writes request data into a fixed stack buffer without checking its size. Oversized data runs past the end of the buffer, which can crash the camera or let an attacker run code.
Network cameras are attractive targets: they run for years, they are rarely updated and they often have a path to the internet. A compromised camera can expose video, and can act as a foothold on the network behind it.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced.
Quick check
Which firmware fixes this?
VulnCheck lists firmware before v1.88.00 as affected, so 1.88.00 or later. Confirm on the Sony support page.
Does it need a login?
The record describes remote attackers sending a crafted POST request and does not mention authentication.
Sources
Last reviewed: 19 October 2026.
