| Ubiquiti UniFi G4 Bullet
|
|
Security Grade
Calculator v1
|
Ubiquiti UniFi G4 Bullet
Release Date: 2021-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Ubiquiti's camera/video line has had local library-loading and weak-permission issues (e.g. CVE-2020-24755); no mass physical-tampering case for the G4 Bullet was identified.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
Published CVEs concentrate on the UniFi OS/Protect controller rather than the camera firmware itself; the camera inherits controller-side risk (e.g. CVE-2023-24104).
|
| Prior attacks
|
Rare
|
🔗 Proof
|
No UniFi Protect camera model appears in CISA KEV; Ubiquiti AirOS appears in KEV but is a different product family.
|
| Updatability
|
Very common
|
🔗 Proof
|
Firmware is centrally pushed by the Protect controller, with staged auto-update as the default deployment model.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
Devices are adopted and authenticated by a UniFi Protect controller using its own identity store, with optional SSO/2FA on the console.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Camera-to-controller traffic is encrypted and the camera does not expose an unauthenticated local web interface.
|
| Storage
|
No encryption
|
🔗 Proof
|
Protect recordings are written to the NVR disk without documented at-rest encryption or per-camera key management.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
Central account management on the console with local/remote users, roles, SSO and 2FA.
|
| Authentication
|
Secure
|
🔗 Proof
|
Console login supports 2FA and SSO; camera access is always brokered by an authenticated controller session.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
UniFi OS enforces login rate limiting and temporary lockout with configurable policy.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Console keeps system/administrator event logs and camera connection history, though per-camera authentication auditing is limited.
|
| Passwords
|
Require change after setup with complexity requirements
|
🔗 Proof
|
Console requires a strong administrator password at setup with complexity enforcement and optional 2FA.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
UniFi Protect firmware (Companion App: UniFi Protect (web/app))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: UniFi Protect NVR (UNVR/UDM) or Protect-enabled console
|
| Power, Battery & Charging
|
Battery: • Power: 802.3af PoE • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Gigabit Ethernet (PoE), managed only through UniFi Protect
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Reasoning: The G4 Bullet is a managed PoE camera with no direct cloud dependency: it is adopted by a UniFi Protect console, inherits console SSO/2FA and receives centrally pushed firmware. Its weaknesses are the absence of documented at-rest encryption for NVR recordings and the fact that most published UniFi CVEs target the controller, meaning the camera's security is only as good as the console it is paired with. Scope note: rated for a current Protect console deployment on a segmented network; the same camera managed by an unpatched or internet-exposed console would score lower. Release date is the G4 series launch (year-level precision).
