Arlo Essential Indoor Camera (VMC2040)
From Wiki-IoT
Revision as of 14:50, 25 October 2026 by TJUTZT (talk | contribs) (Student assignment submission for IoT security assessment)
(diff) ← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Arlo Essential Indoor Camera (VMC2040) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Arlo Essential Indoor Camera
Brand: Arlo (Parent: Arlo Technologies, Inc.) Category: Camera • Model / Gen: 1st generation (2021) VMC2040-100AUS Release Date: 2021-03-02 • Status: End of sale Classification Date: 2026-10-25 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | https://www.arlo.com/content/dam/arlo/support/sell-sheets/essential-indoor/Arlo%20Essential%20Indoor%20Sell%20Sheet_%20UK%20.pdf 🔗 Proof | No on-camera storage, privacy shield and wall mount, but no tamper alarm; no public physical-tampering campaign found. |
| Known vulnerabilities | Rare | https://nvd.nist.gov/vuln/detail/CVE-2021-31505 https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Arlo&resultsPerPage=50 🔗 Proof | NVD lists older Arlo base-station hardcoded-credential and physical-access privilege-escalation CVEs. None are VMC2040-specific, but the Arlo camera ecosystem has a CVE history, so Rare. |
| Prior attacks | None | https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Arlo%20Technologies&resultsPerPage=10 🔗 Proof | No public device-exploitation campaign or CISA KEV record found. |
| Updatability | Very common | https://www.arlo.com/en_gb/support/arlo-essential-indoor 🔗 Proof | Firmware updates automatically; manual update is available in the Arlo Secure app; support FAQ updated in 2025. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Full | https://www.arlo.com/content/dam/arlo/support/sell-sheets/essential-indoor/Arlo%20Essential%20Indoor%20Sell%20Sheet_%20UK%20.pdf 🔗 Proof | Supports Alexa, Google Assistant, HomeKit (via SmartHub) and IFTTT. |
| Communications | Encrypted with up-to-date encryption | https://asia.arlo.com/cameras/essential/VMC2040-100AUS.html 🔗 Proof | Vendor states AES-128 plus TLS between camera/base and cloud; account authentication uses HTTPS. |
| Storage | Encrypted with up-to-date encryption | https://www.arlo.com/content/dam/arlo/support/sell-sheets/essential-indoor/Arlo%20Essential%20Indoor%20Sell%20Sheet_%20UK%20.pdf 🔗 Proof | Cloud recordings are AES-128 encrypted; the camera has no local storage, optional USB storage via SmartHub. |
| Category Score | Score: 1 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | https://www.arlo.com/en_gb/support/faq/000062288/what-is-two-step-verification-and-how-doi-set-it-up 🔗 Proof | Arlo account, friend privileges, trusted devices and Privacy Center device/authorization management are supported. |
| Authentication | Secure | https://www.arlo.com/en_eu/support/faq/3003/How-does-Arlo-keep-my-videos-private-and-secure-in-the-cloud 🔗 Proof | Two-step verification is required for all Arlo accounts, with strict password requirements and login throttling. |
| Brute-force protection | Exist | 🔗 Proof | Arlo limits login attempts to a maximum of five attempts over five minutes. |
| Event logging | Access event logged | https://www.arlo.com/en_gb/support/faq/000063233/arlo-account-security-tips 🔗 Proof | Account Activity Alerts notify of password changes or new-device access; Privacy Center lists authorized devices. |
| Passwords | Require change after setup with complexity requirements | https://www.arlo.com/en_gb/support/faq/000063233/arlo-account-security-tips 🔗 Proof | Vendor states strict password requirements and recommends upper/lower, numbers and symbols; new accounts must set a password and 2FA. |
| Category Score | Score: 1 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | N/A (embedded firmware, not publicly disclosed) (Companion App: Arlo Secure app (iOS/Android)) |
| Hardware (CPU / GPU) | CPU: N/A • GPU: N/A |
| Memory & Storage | Memory: N/A • Storage: Cloud (Arlo Secure); no on-camera local storage; optional SmartHub USB storage |
| Power, Battery & Charging | Battery: None (wired power) • Power: Mains power adapter via micro-USB • Charging: N/A (no battery) |
| Display & Camera | Display: None • Camera: 1920x1080 (1080p), 130° diagonal FOV, 12x digital zoom, 850nm IR with IR-cut, H.264, image-based motion detection |
| Sound & Connectivity | Sound: Full-duplex 2-way audio, single mic with noise/echo cancellation, built-in siren • Connectivity: 2.4 GHz Wi-Fi direct; micro-USB power; optional SmartHub/Base (VMB5000/4540/4500/4000); Alexa/Google/HomeKit |
| Physical (Dimensions & Mass) | Dimensions: 52 x 49 x 113.19 mm (2.0 x 1.9 x 4.5 in) • Mass: 122 g (0.27 lb) |
Student assignment submission for IoT security assessment.
