AXIS Thermal Camera Q1972-E (Q1972-E)

AXIS Thermal Camera Q1972-E (Q1972-E)
Security Grade B Calculator v1	AXIS Q1972-E Thermal Camera Brand: Axis Communications (Parent: Canon) Category: Thermal network camera • Model / Gen: Q1972-E model; numbered generation not specified in cited manufacturer documentation. Q1972-E Release Date: 2025-01-21 • Status: Classification Date: 2026-10-26 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	The IK10 rating excludes the front window; removable media and power interfaces remain physical attack surfaces despite hardware protections. Rare is a qualitative resistance judgment. Evidence boundary: The methodology defines physical resistance but no frequency thresholds. This score does not assert that a physical exploit has been observed or tested. Additional primary evidence: source 2.
Known vulnerabilities	Rare	🔗 Proof	Historical CVE-2026-6181 was fixed in 12.11.13, before the stated model baseline. Evidence boundary: Rare describes a bounded documented vulnerability history, not a measured prevalence or assurance that all possible flaws are eliminated. Additional primary evidence: source 2.
Prior attacks	None	🔗 Proof	No model-specific campaign identified in reviewed public sources; undisclosed or later attacks remain possible. Evidence boundary: None is the closest available form choice for no incident identified. The cited advisory only addresses one CVE at its publication date; no Unknown choice is available. Additional primary evidence: source 2.
Updatability	Very common	🔗 Proof	The model support page supplies maintained firmware and earlier releases. Update availability is documented; installation was not tested.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Account checks authenticate management users, but the enabled HTTP path does not cryptographically authenticate the device to its client. Evidence boundary: HTTPS and stronger integration authentication are available. They do not remove the separately enabled HTTP path in this baseline.
Communications	No encryption	🔗 Proof	HTTP and HTTPS coexist in the documented stock service profile. The weakest enabled management path is plaintext; this does not mean TLS is unsupported. Evidence boundary: The rubric lacks a mixed-encryption choice. Score 3 represents the unencrypted control path, not every connection. HTTPS-only hardening would change this criterion to 1.
Storage	Encrypted with up-to-date encryption	🔗 Proof	The exact model datasheet specifies AES-XTS-Plain64 256-bit internal filesystem encryption; external recording destinations require separate configuration. Evidence boundary: Internal flash at rest is evaluated. Running-system access and removable or network storage are separate security boundaries.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Separate identities, restricted roles, credential changes and account removal support least privilege. Evidence boundary: Actual deployed users were not inspected.
Authentication	Secure	🔗 Proof	The device requires first-use credentials, has no shared default account, and uses signed OS with secure boot. Optional MFA is not credited. Evidence boundary: Secure is a rubric judgment based on credentials and firmware integrity, not a claim of immunity or compulsory MFA. Physical factory reset remains a separate physical-access risk.
Brute-force protection	Exist	🔗 Proof	The exact model specifies brute-force delay protection; AXIS OS enables it by default from version 11.5. Evidence boundary: A documented countermeasure, not independent evidence from a stress test. Additional primary evidence: source 2.
Event logging	Access event logged	🔗 Proof	Maintained AXIS OS records authentication and access events; long-term retention requires external collection. Evidence boundary: No unlimited local retention is claimed.
Passwords	Require change after setup	🔗 Proof	Mandatory initial administrator creation replaces a shared default identity with a user-selected credential. Passwords 2 is the disclosed first-setup functional mapping; later forced rotation and mandatory strong complexity are not claimed. Evidence boundary: The form has no exact choice for unique first-use credential creation. Enforced complexity sufficient for option 1 is not credited here. Interpretation: Under the methodology prose about first-setup credentials, unique initial credentials are mapped to option 2. This does not assert forced later rotation or that the label is a literal description of every workflow.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	AXIS OS 12.11.118 LTS 2026 (assessed baseline) (Companion App: Browser interface; AXIS Device Manager; compatible AXIS Camera Station Edge/Pro software.)
Hardware (CPU / GPU)	CPU: Axis ARTPEC-8 SoC • GPU: Separate GPU not specified; ARTPEC-8 includes a deep-learning processing unit (DLPU).
Memory & Storage	Memory: 2048 MB RAM • Storage: 8192 MB internal flash; microSD/SDHC/SDXC and NAS recording supported (media not specified).
Power, Battery & Charging	Battery: Not applicable to normal operation: externally powered via PoE or DC. • Power: PoE Type 1 Class 3: 5.0 W typical, 12.95 W max; or 12-28 V DC: 4.8 W typical, 12.95 W max. • Charging: Not applicable; uses external PoE/DC power.
Display & Camera	Display: No integrated display specified; viewing through browser/VMS. • Camera: 640 x 480 uncooled thermal microbolometer; 8-14 micrometre band; 10/19/25/35 mm lens variants.
Sound & Connectivity	Sound: 3.5 mm microphone/line input; speaker pairing for output; two-way audio supported. • Connectivity: 10/100/1000BASE-T RJ45 with PoE; alarm I/O; HTTP/HTTPS, RTSP/RTP and ONVIF support.
Physical (Dimensions & Mass)	Dimensions: Manufacturer drawing: 272 mm overall length in shown mount orientation; camera head 151 mm long and 95 mm wide; mounting base diameter 132 mm. • Mass: 1.4 kg

Assessment scope

Documentation-based assessment of the normal commissioned Q1972-E with AXIS OS 12.11.118 LTS 2026. Initial account creation is mandatory. Optional HTTPS-only operation and federated MFA are not assumed. Historical firmware disclosures are distinguished from the supported baseline.

Method and evidence boundaries

This is a documentary case-study assessment of the exact hardware, firmware and explicitly stated configuration, reviewed on 24 October 2026. No physical installation, penetration test or traffic capture by the author is claimed. Historical flaws do not establish current unpatched exposure. The website supplies qualitative categories rather than statistical thresholds: repeated real maintenance supports Updatability 1; isolated/uncertain maintenance supports2; a documented no-update condition supports3. Vulnerability/attack frequency labels are reasoned judgments, and a laboratory demonstration is not an observed campaign. None for prior attacks means no exact-model field campaign established in the reviewed sources, not proof of lifetime absence. Communications follows the least-protected enabled path carrying control, credentials or application payloads; a DNS/discovery packet alone is not used to label an entire device unencrypted. Storage evaluates confidential device-resident flash contents, not merely cloud security or whether executable firmware is readable. For Passwords, the methodology discusses first-setup credentials and expressly allows unique initial passwords. Where mandatory first-use creation or explicitly configured unique credentials do not match a shared-default-change label literally, option2 is a disclosed functional mapping, not a claim of forced periodic rotation. Option1 additionally requires enforced complexity; option3 requires positive evidence of common, predictable or unprotected access. Dates preserve the identified manufacturer announcement/availability or clearly identified primary regional catalog basis. No arbitrary first-of-month date is inserted. The calculated IDRS device grade is not a manufacturer certification or a student assignment mark.

Calculated IDRS: 2 + 2 + 2 = 6 (B).

Date basis: Official dated public product announcement; commercial availability is described separately. This is not a verified first-retail-sale day. Date source: https://newsroom.axis.com/en-gb/news/thermal-cameras-reliable-detection

Patch/support context: Historical CVE-2026-6181 was fixed before the specified baseline; its disclosure is not treated as current unpatched exposure.

Product-specific boundaries: This is a documentary case study of the specified firmware and configuration, not an installed-device test. Frequency labels are qualitative assessments; no numerical frequency thresholds are supplied by the website. Prior-attacks None is a bounded exact-model search result and not proof of lifetime absence.

Hardware and general-information supplement

Supplement reviewed on 25 October 2026. Manufacturer model specifications and explicitly identified historical manuals support the added fields. Hardware capabilities do not imply that optional services, accessories or every capacity variant are enabled in the assessed case. Unpublished or unverified parameters are identified rather than guessed. Current sale/support status is separate from the original historical firmware/configuration assessment; the twelve security selections and original evidence have not been changed.

Specification evidence

• Generation, Dimensions, Mass, CPU, GPU, Memory, Storage, Battery, Power, Charging, Camera, Sound, Connectivity: source 1.
• Status, Operating system: source 1.
• Companion App: source 1; source 2.
• Display: source 1.

Specification qualifications

• Dimensions were read from the manufacturer dimension drawing, including its shown adjustable-mount orientation.
• Lens options describe the Q1972-E family; no particular lens variant is assumed installed.
• The optional Status selector is left unset: the reviewed sources do not establish a reliable current sale/end-of-sale/end-of-life category. Firmware maintenance or an existing product page alone is not treated as proof of sale status.