AXIS Q3536-LVE

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Physical SD/reset access remains possible. Rare is a qualitative exposure estimate, not measured incident frequency.
Known vulnerabilities	Rare	🔗 Proof	Historical OS vulnerabilities; patch before deployment.
Prior attacks	None	🔗 Proof	No model-specific in-the-wild attack identified in reviewed sources; absence is unproven.
Updatability	Very common	🔗 Proof	Multiple supported firmware releases; OS support through 2033-12-31.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Full	🔗 Proof	Certificate authentication supported; configuration assumed.
Communications	Encrypted with up-to-date encryption	🔗 Proof	Use HTTPS and secure streaming; disable plaintext services.
Storage	Encrypted with up-to-date encryption	🔗 Proof	Enable SD encryption.
Category Score	Score: 1 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Role-based account administration.
Authentication	Basic	🔗 Proof	Local username/password access; no MFA assumed.
Brute-force protection	Exist	🔗 Proof	Brute-force delay available.
Event logging	Access event logged	🔗 Proof	Successful and failed authentications logged.
Passwords	Require change after setup	🔗 Proof	Initial password creation required; complexity is not assumed enforced.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	AXIS OS; assessed baseline 12.11.118 LTS 2026 (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Assessment scope

Desk research, 2026-10-22. No physical unit or installed firmware was tested. ARTPEC-8; 4 MP; rugged dome, with TPM-backed key protection. Key protection alone does not encrypt recordings.

Assessed configuration: AXIS OS 12.11.118 LTS 2026 (listed on the model support page), HTTPS/secure video transport, authenticated integrations, encrypted SD storage, anonymous access disabled, brute-force delay and audit logging enabled. Verify these settings on the actual deployment. Local authentication remains password-based and a mandatory complexity policy is not assumed. This is a conditional capability assessment, not a verified factory-default assessment.

The release-date field uses the dated manufacturer announcement below as a documented reference point; regional announcement dates can differ from global first-sale dates.

Method and limitations

WikiIoT v1: Device CATS=ceil((2+2+1+1)/4)=2; System CATS=ceil((1+1+1)/3)=1; User Authentication CATS=ceil((1+2+1+1+2)/5)=2. GRAS=5, provisional grade A-. Admin approval/calculator determines the published result.

The rubric has no Unknown option. Hardware tampering and vulnerability frequency are qualitative estimates, not measured prevalence. Prior attacks=None means no model-specific confirmed in-the-wild attack was found in the reviewed material, not proof that none occurred. Shared AXIS OS CVEs are historical evidence; actual applicability depends on firmware, features and privileges. CVE-2025-9055 concerns privileged edge-storage API abuse; the vendor lists fixed versions. Do not equate this CVE with a demonstrated attack on this particular model.

Sources

• Model-specific manual
• Firmware and lifecycle
• Manufacturer announcement/date reference
• Vendor security advisories
• AXIS OS hardening guide
• AXIS OS account/security/logging interface

Deployment priorities

Install supported patches, restrict management to a dedicated network, protect physical access, use unique strong passwords and least-privilege accounts, enable encryption and remote logging, and verify service settings after updates.