| Amcrest IP2M-841B (IP2M-841B)
|
|
Security Grade
Calculator v
|
Amcrest IP2M-841B
Release Date: 2016-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Indoor plastic camera with screwed case; no public mass-tampering campaign found for this model.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
CVE-2019-3948: unauthenticated access to the /videotalk endpoint allows remote audio listening; affects IP2M-841B V2.520.AC00.18.R. Other Amcrest CVEs should be checked in NVD.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
No IP2M-841B-specific botnet campaign found; Amcrest cameras are Dahua OEM and a plausible Mirai-family target, so Rare rather than None.
|
| Updatability
|
Rare
|
🔗 Proof
|
Amcrest publishes firmware through its support/forum channels, but update cadence for this older model is limited.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
No
|
🔗 Proof
|
CVE-2019-3948 shows the /videotalk HTTP endpoint can be reached without authentication.
|
| Communications
|
Encrypted with obsolete encryption
|
🔗 Proof
|
HTTP/RTSP access is common in default deployments; TLS support is limited or legacy. Verify with the current firmware.
|
| Storage
|
No encryption
|
🔗 Proof
|
microSD/NVR footage is not documented as encrypted at rest.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Single admin account; no role separation or central lifecycle management.
|
| Authentication
|
Basic
|
🔗 Proof
|
Password-only web/app login; no MFA.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Some firmware builds lock accounts after repeated failures; behaviour is model/firmware dependent.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
On-device log of logins/alarms exists; no central audit trail.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Setup requires creating an admin password; no default password was confirmed, but complexity enforcement should be verified.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Amcrest firmware (Companion App: Amcrest View Pro)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Wi-Fi 2.4 GHz, Ethernet, RTSP/ONVIF
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Amcrest IP2M-841B is a 1080p indoor Wi-Fi camera. It can be managed through the Amcrest View Pro app and a web interface. CVE-2019-3948 allows unauthenticated access to the /videotalk endpoint on firmware V2.520.AC00.18.R, which can expose live audio.
