(
diff)
← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| AXIS Dome Camera (Q3538-LVE)
|
|
Security Grade
Calculator v1
|
AXIS Q3538-LVE Dome Camera
Release Date: 2021-10-05 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
[1] [2] 🔗 Proof
|
ARTPEC-8 had a physical secure-boot bypass in older 10.9-11.11 firmware; selected 12.11 is outside that range.
|
| Known vulnerabilities
|
Rare
|
[3] 🔗 Proof
|
CVE-2026-6181 affected earlier AXIS OS; its 12.11.13 fix precedes the selected version.
|
| Prior attacks
|
None
|
[4] 🔗 Proof
|
No Q3538-LVE-specific field incident established in the reviewed vendor notices; coverage is limited.
|
| Updatability
|
Very common
|
🔗 Proof
|
Q3538-LVE has a published software history and a downloadable 12.11.118 LTS image.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
[5] 🔗 Proof
|
Rating assumes certificate-validated integration and mutual EAP-TLS; anonymous access is off.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
TLS 1.2/1.3 capability; rating requires encrypted management and media with plaintext services disabled.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Datasheet specifies AES-XTS-Plain64 256-bit internal filesystem protection; SD/NAS require separate checks.
|
| Category Score
|
Score: 1 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
[6] 🔗 Proof
|
Separate administrator, operator and viewer accounts; account editing and deletion are documented.
|
| Authentication
|
Basic
|
🔗 Proof
|
Login is required, but a physical control-button factory reset does not require the previous credentials.
|
| Brute-force protection
|
Exist
|
[7] 🔗 Proof
|
Documented login-delay/IP-blocking protection is included; it must remain enabled.
|
| Event logging
|
Access event logged
|
[8] 🔗 Proof
|
Access/audit event recording is required for this score; verify logging and retention during installation.
|
| Passwords
|
Require change after setup
|
[9] 🔗 Proof
|
First-use administrator password is mandatory. Optional 12.9+ complexity enforcement is not assumed enabled.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
AXIS OS 12.11.118 (LTS 2026; selected assessment version) (Companion App: Browser device interface; AXIS Device Manager)
|
| Hardware (CPU / GPU)
|
CPU: ARTPEC-8 SoC; deep learning processing unit (DLPU) • GPU:
|
| Memory & Storage
|
Memory: 2048 MB RAM; 8194 MB (as stated in the datasheet) flash • Storage: microSD/microSDHC/microSDXC; recording to NAS supported
|
| Power, Battery & Charging
|
Battery: • Power: PoE IEEE 802.3at Type 2 Class 4: typical 9 W, maximum 23 W; 10-28 V DC: typical 9 W, maximum 24 W • Charging:
|
| Display & Camera
|
Display: • Camera: 1/1.2-inch CMOS; 3840 x 2160 (8 MP); 6.2-12.9 mm F1.6-2.9 lens; 25/30 fps with WDR, up to 50/60 fps without WDR; IR up to 40 m
|
| Sound & Connectivity
|
Sound: Microphone/line input and line output • Connectivity: Gigabit RJ45 Ethernet, PoE, DC input and configurable I/O
|
| Physical (Dimensions & Mass)
|
Dimensions: Height 124 mm (184 mm with weathershield); diameter 183 mm • Mass: 2.1 kg including weathershield
|
Assessment scope
Documentary assessment of Q3538-LVE, checked 2026-10-23; no physical camera was tested. The selected, vendor-listed firmware is AXIS OS 12.11.118 LTS 2026. The communication/authentication scores describe a deployment using trusted certificates, mutual EAP-TLS, encrypted management and media, no anonymous viewing, and disabled unused plaintext protocols. Login protection and access/audit recording must be enabled and checked. These are explicit assessment conditions, not observations of an installed device. Optional password-complexity enforcement is not credited. Firmware availability does not establish that every disclosed issue is fixed.
- 8 MP dome with a 1/1.2-inch sensor; the 4 MP Q3536-LVE lens and sensor specifications do not apply.
- The release-date field uses the dated official announcement (2021-10-05); first retail shipment was not verified.
- Rare is a qualitative rubric judgement, not an estimate of incident frequency. None for prior attacks means no confirmed model-specific incident in this source review, not proof that attacks never occurred.
- The encrypted-storage criterion concerns internal flash. Network recordings and removable media are separate security boundaries.
- Unverified optional specifications, including GPU and commercial status, are left blank.
IDRS calculation
Device ceil((2 + 2 + 1 + 1)/4) = 2; System ceil((1 + 1 + 1)/3) = 1; User Authentication ceil((1 + 2 + 1 + 1 + 2)/5) = 2. GRAS = 5; calculated grade A-. Contributor calculation; administrator approval remains separate.
Sources
