| AXIS Dome Camera (M3125-LVE)
|
|
Security Grade
Calculator v1
|
AXIS M3125-LVE Dome Camera
Release Date: 2024-09-17 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Qualitative residual physical-access risk: reset controls and removable media remain relevant despite secure boot and IK08 housing; this is not a measured incident frequency.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
Nonzero AXIS OS vulnerability history: CVE-2025-0324 affected OS 11.8-12.2; fixed in 12.3.33/11.11.140. This does not assert that current patched firmware is affected.
|
| Prior attacks
|
None
|
🔗 Proof
|
No exploitation was known to Axis when this advisory was published. No model-specific attack identified in the cited records; this is limited evidence, not proof of no attacks.
|
| Updatability
|
Very common
|
🔗 Proof
|
Supported, vendor-published software updates.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
Assessed with certificate-validated EAP-TLS and authenticated integrations configured.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Assumes HTTPS and encrypted media transports; disable plaintext services.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Encrypted filesystem is documented; assumes SD encryption is enabled.
|
| Category Score
|
Score: 1 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
Administrator, operator and viewer privileges support account lifecycle management.
|
| Authentication
|
Basic
|
🔗 Proof
|
Conservative local password-login assessment; no assumption of MFA.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
Brute-force delay protection is documented.
|
| Event logging
|
Access event logged
|
🔗 Proof
|
Access and audit logs document authentication activity on supported software.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
An administrator password must be created on first use; the manual does not mandate complexity. This is the closest rubric choice.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
AXIS OS (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: Ambarella CV25 SoC • GPU:
|
| Memory & Storage
|
Memory: 1024 MB RAM; 512 MB flash • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: PoE IEEE 802.3af/802.3at Type 1 Class 3; typical 3.7 W, maximum 10.5 W • Charging:
|
| Display & Camera
|
Display: • Camera: 1920 x 1080, 2 MP; 1/2.8-inch progressive-scan RGB CMOS
|
| Sound & Connectivity
|
Sound: • Connectivity: 10BASE-T/100BASE-TX Ethernet (RJ45), PoE; microSD edge storage
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Scope
Documentary security assessment, 23 October 2026; no hands-on testing. Ratings assess a supported, patched and hardened configuration with verified TLS, authenticated integrations, anonymous access disabled, and encryption enabled for retained video. These controls are capabilities, not a claim about every factory default. Historical vulnerability and attack evidence is scoped to the referenced disclosure. 'Rare' is a qualitative rubric judgment, not an observed event rate. Release-date field uses the manufacturer announcement, not a verified first-sale date. Review the rating if configuration or software support changes.
Release-date note: 2024-09-17 is the manufacturer announcement date; the exact first retail availability is unverified.
Scoring
Device ceil((2+2+1+1)/4)=2; System ceil((1+1+1)/3)=1; User Authentication ceil((1+2+1+1+2)/5)=2. GRAS=5; IDRS grade A-.
Additional security note
Brute-force protection: Brute-force delay protection is documented.
References
