AXIS M2035-LE

AXIS M2035-LE
Security Grade B Calculator v	AXIS M2035-LE Bullet Camera (standard 3.2 mm lens) Brand: AXIS (Parent: Axis Communications AB (Axis AB group)) Category: Network camera • Model / Gen: AXIS M20 bullet series; deep-learning-enabled generation M2035-LE (standard 3.2 mm lens; not the 8 mm variant) Release Date: 2022-03-23 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	https://help.axis.com/en-us/axis-m2035-le 🔗 Proof	Provisional Rare rating based on physical-modification resistance, not incident statistics: IK08 enclosure, secure boot and protected key storage provide barriers, but physical access, power interruption or removal remain possible. No immunity to tampering is claimed.
Known vulnerabilities	Rare	https://www.axis.com/products/axis-m2035-le/support 🔗 Proof	Rare is a qualitative historical assessment, not a measured disclosure rate. CVE-2025-5454 affected AXIS OS 12.0.0-12.6.17 and was patched in 12.6.18. Exploitation requires unsigned ACAP installation to be allowed and the victim to install a malicious application. The model supports affected-era AXIS OS releases; current patched releases are not asserted vulnerable.
Prior attacks	Rare	https://www.axis.com/support/cybersecurity/vulnerability-management 🔗 Proof	Pending verification: no reliable model-specific in-the-wild attack record was identified in this review. The cited advisory reports no exploitation known to Axis for CVE-2025-5454 at its publication, but does not establish an attack-free history for this camera. Required rating intentionally unselected.
Updatability	Very common	https://help.axis.com/en-us/axis-os-release-notes 🔗 Proof	Repeated active and LTS AXIS OS releases are available for this model. The support page lists software support until 2033-12-31. Very common is a qualitative rating of ongoing update availability, not a guaranteed update interval.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	https://help.axis.com/en-us/axis-os-web-interface-help 🔗 Proof	Partial overall: EAP-TLS supports mutual certificate authentication when client and trusted CA certificates are configured. Other integrations use different authentication methods; mutual authentication is not established for every possible service/configuration.
Communications	Encrypted with up-to-date encryption	🔗 Proof	Current model datasheet lists TLS 1.2/1.3, HTTPS/HSTS and protected streaming options. Rating concerns supported secure configurations; plain HTTP and other legacy/unencrypted protocols must be disabled or restricted as appropriate.
Storage	Encrypted with up-to-date encryption	🔗 Proof	The current model datasheet explicitly lists an encrypted filesystem using AES-XTS-Plain64 256-bit, separately from optional SD-card encryption. This is documented capability; firmware/configuration on an individual device has not been inspected.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Administrators can create, update and remove ordinary accounts; Administrator, Operator and Viewer roles provide different privileges. Built-in/protected account restrictions still apply.
Authentication	Basic	https://help.axis.com/en-us/axis-os-web-interface-help 🔗 Proof	Conservative Basic rating for local account authentication: user-created credentials and Digest/HTTPS access are documented. OpenID integration is optional; local multi-factor authentication and recovery-proof authentication are not assumed.
Brute-force protection	Exist	https://help.axis.com/en-us/axis-os-web-interface-help 🔗 Proof	Documented brute-force delay protection and configurable authentication-failure blocking are available. Actual protection depends on supported firmware and enabled settings.
Event logging	Access event logged	🔗 Proof	AXIS OS documents failed-access logs and audit logs covering successful/failed authentication and configuration activities. This rates available logging functionality, not verified log retention on a tested camera.
Passwords	Require change after setup	🔗 Proof	Initial access requires creation of an administrator account; there is no default account. The second form option is used for mandatory initial credential creation. The model manual does not impose mandatory password complexity; later configurable policy options do not prove first-setup enforcement.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	AXIS OS; supported active/LTS tracks listed on the model support page (Companion App: AXIS Camera Station Edge / Pro; browser interface; AXIS Device Manager for administration)
Hardware (CPU / GPU)	CPU: CV25 system-on-chip; CPU clock not specified in the official datasheet • GPU: Dedicated GPU not specified; deep learning processing unit (DLPU) documented
Memory & Storage	Memory: 1024 MB RAM • Storage: 512 MB flash; microSD/microSDHC/microSDXC; NAS recording supported
Power, Battery & Charging	Battery: PoE-powered; no operational battery specified; RTC backup battery not verified • Power: PoE IEEE 802.3af/802.3at Type 1 Class 3; typical 5 W, maximum 12.95 W • Charging: Not applicable - powered over Ethernet, not a rechargeable device
Display & Camera	Display: No built-in graphical display specified; browser/video-management interface • Camera: 1/2.9-inch RGB CMOS; 1920 x 1080 at 25/30 fps; 3.2 mm F1.4 fixed lens; IR illumination
Sound & Connectivity	Sound: Audio supported via Portcast accessories or paired network speakers; no integrated microphone/speaker claimed • Connectivity: RJ45 10BASE-T/100BASE-TX with PoE; IPv4/IPv6; HTTPS, ONVIF, RTSP/SRTP; no built-in Wi-Fi specified
Physical (Dimensions & Mass)	Dimensions: 170 mm length; 101 mm diameter • Mass: 491 g

RESEARCH DRAFT - PRIOR ATTACKS RATING PENDING. Scope: standard AXIS M2035-LE with 3.2 mm lens, using current manufacturer documentation and supported AXIS OS capabilities; not a tested physical installation. Release date 2022-03-23 is the documented public announcement date, accepted for this draft, not a verified first-retail-sale date. Announcement source: https://newsroom.axis.com/en-us/press-release/axis-communications-announces-new-video-audio-and-analytics-solutions-at-isc-west . Hardware source: https://www.axis.com/dam/public/2b/84/38/datasheet-axis-m2035-le-bullet-camera-en-US-367672.pdf . Current security-feature source: https://www.axis.com/dam/public/cc/31/2a/datasheet-axis-m2035-le-bullet-camera-en-US-555402.pdf . Manufacturer and group information: https://www.axis.com/about-axis/corporate-governance/the-axis-group . Ratings are qualitative assessments, not attack-frequency statistics. Modern communications assumes secure protocols are used; optional insecure services are not assumed protected. Current datasheet explicitly documents encrypted filesystem and SD-card encryption. Some generic AXIS OS web-interface features depend on installed version/model support. No reliable model-specific in-the-wild attack history was established; Prior attacks remains unselected by agreement. No absence of attacks, complete physical-tamper resistance or security of every historical software version is claimed. CPU clock, discrete GPU and RTC battery are not specified or verified.