{"id":"CVE-2020-7222","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-7222","generatedAt":"2026-10-27T23:42:39.161Z","title":"An attacker who changes the result parameter (to true) in this JavaScript code can bypass authentication and achieve limited privileges (ability to see every option but not modify them).","description":"An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter (to true) in this JavaScript code can bypass authentication and achieve limited privileges (ability to see every option but not modify them).","published":"2020-01-18T00:15:12.000Z","lastModified":"2026-06-17T03:24:32.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-287"],"affected":["amcrest/web server"],"epss":{"score":0.01285,"percentile":0.69934,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.29%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://sku11army.blogspot.com/2020/01/amcrest-2520ac0018r-login-bypass.html","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://sku11army.blogspot.com/2020/01/amcrest-2520ac0018r-login-bypass.html","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-7222","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}