AXIS Panoramic Camera P3738-PLE

AXIS Panoramic Camera P3738-PLE
Security Grade B Calculator v1	AXIS P3738-PLE Panoramic Camera Brand: AXIS (Parent: Canon Inc. (Canon Group)) Category: IP camera • Model / Gen: AXIS P37 Series P3738-PLE Release Date: 2023-11-13 • Status: In sale Classification Date: 2026-10-26 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	The exact-model manual documents a physical control-button-based factory reset that clears device configuration and allows new administrator provisioning. Under the rubric’s broad ports/power/parts definition, Rare is a qualitative physical-access capability rating, not proof of a malicious tampering incident.
Known vulnerabilities	Rare	[https://www.axis.com/dam/public/48/ab/82/cve-2025-5454pdf-en-US-504213.pdf https://www.axis.com/dam/public/15/2f/e7/datasheet-axis-p3738-ple-panoramic-camera-en-US-463589.pdf https://www.axis.com/products/axis-p3738-ple/support 🔗 Proof]	CVE-2025-5454 documents an AXIS OS 12.0.0–12.6.17 ACAP configuration-validation issue, fixed in 12.6.18. This model supports ACAP. Exploitation additionally requires allowing unsigned applications and installing a malicious application. Rare is a qualitative historical mapping, not an unpatched-deployment claim.
Prior attacks	None	[https://help.axis.com/en-us/security-advisories https://www.axis.com/dam/public/48/ab/82/cve-2025-5454pdf-en-US-504213.pdf 🔗 Proof]	No malicious IoT campaign naming P3738-PLE was identified in the bounded exact-model manual and vendor-advisory review completed on 24 October 2026. None records this limited review result; it is not proof that attacks never occurred. A vulnerability disclosure or factory-reset example is not a real-world malicious incident.
Updatability	Very common	[https://www.axis.com/products/axis-p3738-ple/support https://help.axis.com/en-us/axis-p3738-ple https://www.axis.com/products/axis-p3738-ple 🔗 Proof]	Axis provides model-specific AXIS OS downloads and recurring active/LTS maintenance releases. The product page states software support until 2035-12-31. Very common is a qualitative maintenance rating, not a fixed monthly-cadence promise.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[https://www.axis.com/dam/public/15/2f/e7/datasheet-axis-p3738-ple-panoramic-camera-en-US-463589.pdf https://help.axis.com/en-us/axis-os-knowledge-base 🔗 Proof]	IEEE 802.1X/EAP-TLS supports certificate-based mutual authentication when a trusted CA, client certificate and key are configured. This is not mandatory for every supported integration; optional legacy and discovery traffic prevent a blanket full-authentication claim.
Communications	Encrypted with up-to-date encryption	[https://www.axis.com/dam/public/15/2f/e7/datasheet-axis-p3738-ple-panoramic-camera-en-US-463589.pdf https://help.axis.com/en-us/axis-p3738-ple https://help.axis.com/en-us/axis-os-web-interface-help 🔗 Proof]	TLS 1.2/1.3, HTTPS/HSTS and SRTP/RTSPS support modern encryption for configured management and media paths. This rating assumes encrypted services and certificate validation are enabled and plaintext alternatives disabled; discovery traffic is not claimed to be encrypted.
Storage	Encrypted with up-to-date encryption	[https://www.axis.com/dam/public/15/2f/e7/datasheet-axis-p3738-ple-panoramic-camera-en-US-463589.pdf https://whitepapers.axis.com/en-us/axis-edge-vault 🔗 Proof]	The exact-model datasheet specifies an encrypted filesystem using AES-XTS-Plain64 with 256-bit encryption. Axis describes hardware-protected filesystem keys for persistent read/write data, including configuration. This assessment concerns internal flash data, not merely optional SD-recording encryption.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	[https://help.axis.com/en-us/axis-p3738-ple https://help.axis.com/en-us/axis-os-web-interface-help 🔗 Proof]	AXIS OS supports distinct administrator, operator and viewer roles, creation of lower-privilege accounts, password changes, and account deletion. The exact-model manual directs administrators to the AXIS OS account-management interface.
Authentication	Basic	[https://help.axis.com/en-us/axis-p3738-ple https://www.axis.com/dam/public/15/2f/e7/datasheet-axis-p3738-ple-panoramic-camera-en-US-463589.pdf 🔗 Proof]	Local access uses administrator-created account credentials. Signed OS and secure boot protect software integrity, but are not a second user factor. A physical factory reset clears credentials and configuration, so Basic is the conservative local-authentication mapping rather than an unrestricted Secure claim.
Brute-force protection	Exist	[https://www.axis.com/dam/public/15/2f/e7/datasheet-axis-p3738-ple-panoramic-camera-en-US-463589.pdf https://help.axis.com/en-us/axis-os-knowledge-base 🔗 Proof]	AXIS OS can temporarily block a client IP after repeated failed HTTP(S) authentication. On 11.5 and later the default example is 20 failed attempts within one second followed by a 10-second block; thresholds are configurable. This is a documented attempt-limiting mechanism, not protection against every distributed attack.
Event logging	Access event logged	[https://help.axis.com/en-us/axis-p3738-ple https://help.axis.com/en-us/axis-os-knowledge-base 🔗 Proof]	The AXIS OS log system can record successful and failed device access. HTTP(S) success logging requires Access Log to be enabled; failed HTTP(S) attempts are logged only for an existing username. Remote syslog is recommended to retain records across resets and reboots.
Passwords	Require change after setup	[https://help.axis.com/en-us/axis-p3738-ple https://fehmijaafar.net/wiki-iot/index.php/Methodology 🔗 Proof]	First access requires creating an administrator account with a personal password; there is no default account on current AXIS OS. The middle label is used for mandatory initial credential provisioning. The model manual does not impose complexity or periodic password-change requirements; recommendations are not treated as enforcement.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	AXIS OS (Companion App: AXIS Camera Station Edge / AXIS Camera Station Pro (optional management software))
Hardware (CPU / GPU)	CPU: ARTPEC-8 SoC • GPU: Not applicable — dedicated ARTPEC-8 video and DLPU processing, not a separate graphics-adapter specification
Memory & Storage	Memory: 4096 MB RAM • Storage: 8192 MB internal Flash; microSD/microSDHC/microSDXC support; NAS recording
Power, Battery & Charging	Battery: Not applicable — fixed-installation PoE-powered endpoint • Power: PoE IEEE 802.3at Type 2 Class 4; IR on: typical 14.98 W, maximum 25.50 W • Charging: Not applicable — powered through PoE, not a rechargeable portable product
Display & Camera	Display: Not applicable — headless network camera; status LEDs • Camera: 4 × 1/2.8-inch RGB CMOS; 4 × 3840 × 2160; up to 12.5/15 fps per channel (50/60 Hz); 3.2–8.1 mm varifocal lenses
Sound & Connectivity	Sound: Two-way audio through optional portcast accessory; network-speaker pairing • Connectivity: Shielded RJ45 10/100/1000BASE-T Ethernet with PoE+
Physical (Dimensions & Mass)	Dimensions: 50 mm height × 255 mm diameter • Mass: 2 kg

Documented hardened deployment, not a physical-unit test: exact P3738-PLE hardware running a supported AXIS OS 12.x release with all applicable security updates and the encrypted filesystem provided for this model. HTTPS and encrypted media are enabled, plaintext alternatives disabled, certificates validated, optional EAP-TLS configured where used, and Access Log plus remote syslog enabled. Local accounts use the first-setup password mechanism described by the model manual; no unsupported complexity or periodic rotation is assumed.