| Hikvision DS-2CD2143G0-I
|
|
Security Grade
Calculator v1
|
Hikvision DS-2CD2143G0-I
Category: Smart Camera • Model / Gen: EasyIP 4.0 DS-2CD2143G0-I (4 MP)
Release Date: 2019-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Physical teardown and UART access are documented in public security research, but no mass hardware-tampering campaign against this model was found. Rated Rare rather than Very common for lack of a device-specific public case.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
Long CVE history for the DS-2CD family, including unauthenticated command injection in the web server (CVE-2021-36260, CVSS 9.8) and improper authentication (CVE-2017-7921, CVSS 9.8).
|
| Prior attacks
|
Very common
|
🔗 Proof
|
CVE-2021-36260 is listed in the CISA KEV catalog, i.e. exploitation observed in the wild; Hikvision cameras are also a classic Mirai-family botnet target.
|
| Updatability
|
Very common
|
🔗 Proof
|
Vendor maintains a public security-advisory feed and firmware download portal; firmware is upgradeable via web UI, batch tool or NVR.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Device authenticates to Hik-Connect / NVR platforms with its own credential store; no federated identity or standards-based SSO.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
HTTPS is supported, but plain HTTP/RTSP and legacy TLS configurations remain common in deployments; the web server itself has been the attack surface of CVE-2021-36260.
|
| Storage
|
No encryption
|
🔗 Proof
|
Configuration files store credentials in a recoverable form (CVE-2017-7923); no at-rest encryption of microSD or NVR footage is documented.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Local admin/operator/viewer accounts managed on-device; no central lifecycle management, self-service recovery or role audit.
|
| Authentication
|
Basic
|
🔗 Proof
|
Username/password only, no MFA; the improper-authentication CVE shows the authentication path has been bypassable.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Some firmware builds lock accounts after repeated failures, but the behaviour is model and firmware dependent and not documented as a platform guarantee.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
On-device log of logins and alarms exists and can be exported, but coverage is limited and no remote/central audit trail is offered.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Since 2015 firmware a unique password must be set at activation; complexity is checked but not uniformly enforced across legacy firmware.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Hikvision embedded Linux firmware (Companion App: Hik-Connect)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: microSD card slot, NVR/NAS recording
|
| Power, Battery & Charging
|
Battery: • Power: PoE (802.3af) / 12 VDC • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: RJ-45 10/100 Ethernet (PoE), ONVIF, RTSP
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Reasoning: The DS-2CD2143G0-I inherits the security profile of the wider DS-2CD family: a documented history of critical, remotely exploitable web-server and authentication flaws, one of which is exploited in the wild and listed in CISA KEV. Local storage and configuration data are not protected at rest and the device exposes plain HTTP/RTSP by default on many firmware builds. Mitigating factors are a maintained security-advisory process, forced password activation and OTA-capable firmware. Scope note: rating reflects default deployment of a current firmware build; an isolated VLAN with HTTPS/TLS-only access and no internet exposure materially raises the effective rating. Release date is the EasyIP 4.0 series introduction (year-level precision).
