Hikvision DS-2CD2387G2-L(U) (DS-2CD2387G2-LU)

Hikvision DS-2CD2387G2-L(U) (DS-2CD2387G2-LU)
Security Grade F Calculator v	Hikvision DS-2CD2387G2-L(U) (DS-2CD2387G2-LU) Brand: Hikvision (Parent: Hangzhou Hikvision Digital Technology Co., Ltd.) Category: Camera • Model / Gen: DS-2CD2387G2-LU Release Date: 2021-01-01 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	—	No published hardware-tampering research specific to this model was found as of 2026-10; the housing is sealed and the microSD slot and reset button are internal.
Known vulnerabilities	Very common	🔗 Proof	CVE-2021-36260 (CVSS 9.8): unauthenticated command injection in the Hikvision web server. NVD lists ds-2cd2387g2-l(u) directly among the 512 affected CPEs, so this is a model-level match rather than a series-level inference.
Prior attacks	Very common	🔗 Proof	The Mirai-based Moobot botnet was observed actively exploiting CVE-2021-36260 in Hikvision cameras shortly after disclosure, as documented by Fortinet and SecurityAffairs.
Updatability	Rare	🔗 Proof	Hikvision published a security advisory and patched firmware for CVE-2021-36260, but updates are applied manually through a local web UI or Hik-Connect; there is no forced or automatic update channel, so field devices frequently remain unpatched.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Exploitation of CVE-2021-36260 requires no credentials at all against the web service, so authentication with other systems provides no effective barrier at that interface.
Communications	No encryption	—	RTSP and HTTP streams on this camera line are not encrypted by default; HTTPS is available but optional. Provisional value, not directly evidenced for this model.
Storage	No encryption	—	Recordings written to the local microSD card are not encrypted at rest. Provisional value, not directly evidenced for this model.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	—	The web interface offers a fixed role set (admin/operator/user) without granular permission control. Provisional value, not directly evidenced for this model.
Authentication	Basic	🔗 Proof	Username/password login exists, but CVE-2021-36260 allows complete bypass of authentication through the web interface.
Brute-force protection	Absent	—	Password guessing against the web login is a documented mass-exploitation vector for Hikvision cameras; no reliable account lockout is exposed in the default configuration.
Event logging	Partial logging	—	The camera keeps a local system log viewable in the web UI, with no centralised or tamper-evident logging. Provisional value, not directly evidenced for this model.
Passwords	Require change after setup	—	Hikvision devices require an admin password to be set on first activation (no factory default admin password since 2015 firmware), but there is no enforced complexity requirement, and mass scanning for weak passwords remains common.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded Linux (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Ethernet (RJ45), PoE
Physical (Dimensions & Mass)	Dimensions: • Mass:

The Hikvision DS-2CD2387G2-L(U) is a 4MP ColorVu fixed turret network camera. Its defining weakness is CVE-2021-36260 (CVSS 9.8), an unauthenticated command injection in the camera web server; NVD explicitly lists ds-2cd2387g2-l(u) among the affected CPEs, so the exposure is confirmed at model level rather than inferred from the product family. The flaw was exploited at scale: the Mirai-derived Moobot botnet targeted Hikvision cameras within weeks of the September 2021 disclosure, and scanning for this endpoint has continued since. Hikvision issued a patched firmware and a public advisory, but the update path is manual, so a large installed base is likely still vulnerable. The device is rated F: an unauthenticated remote compromise path is documented and proven in the wild, and the remaining user-authentication controls are bypassed entirely by that same flaw. Values for communications encryption, storage encryption, account management, brute-force protection and event logging are provisional because no model-level Hikvision documentation could be retrieved; the device is rated F on the strength of the CVE-2021-36260 evidence alone.