Dahua IPC-HFW1200S

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	No mass physical-tampering campaign; issues are network/remote.
Known vulnerabilities	Very common	🔗 Proof	CVE-2024-13131 (CWE-284): unauthenticated access to /web_caps/webCapsConfig discloses configuration and network data. Also CVE-2024-39944 (unauthenticated packet can crash the device) and a broader Dahua authentication-bypass advisory (JVNDB-2024-000007, CWE-287, CVSS 8.1).
Prior attacks	Rare	🔗 Proof	Dahua cameras have been targeted in botnet/credential-stuffing campaigns; no CISA KEV entry for this model.
Updatability	Very common	🔗 Proof	Firmware updates released through Dahua's PSIRT and support portal.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	ONVIF, P2P and NVR integration with device credentials; P2P relies on vendor cloud.
Communications	Encrypted with obselete encryption	🔗 Proof	Management interfaces historically used weak/obsolete TLS and unencrypted options.
Storage	No encryption	🔗 Proof	Local SD/edge recordings are not encrypted at rest by default.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Local user accounts with limited roles; no rich cloud account management.
Authentication	Basic	🔗 Proof	Authentication-bypass flaws (CWE-287) documented across Dahua products.
Brute-force protection	Basic	🔗 Proof	No documented account lockout policy; default credentials are common in the field.
Event logging	Partial logging	🔗 Proof	Event/motion logging present; authentication events not exposed to users as an audit trail.
Passwords	Default/Common/Easy to guess	🔗 Proof	Dahua devices are widely known for default/common credentials if not changed at setup.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded firmware (Companion App: DMSS / gDMSS)
Hardware (CPU / GPU)	CPU: Not publicly specified • GPU: N/A
Memory & Storage	Memory: Not publicly specified • Storage: microSD / NVR
Power, Battery & Charging	Battery: N/A (PoE/wired) • Power: PoE or DC 12V • Charging: N/A
Display & Camera	Display: N/A • Camera: 2 MP bullet camera
Sound & Connectivity	Sound: N/A • Connectivity: Ethernet (PoE)
Physical (Dimensions & Mass)	Dimensions: Not publicly specified • Mass: Not publicly specified