Hikvision DS-2CD2143G0-I

Hikvision DS-2CD2143G0-I
Security Grade D Calculator v1	Hikvision DS-2CD2143G0-I Brand: Hikvision (Parent: Hangzhou Hikvision Digital Technology Co., Ltd.) Category: Smart Camera • Model / Gen: EasyIP 4.0 DS-2CD2143G0-I (4 MP) Release Date: 2019-01-01 • Status: In sale Classification Date: 2026-10-21

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	—	Physical teardown and UART access are documented in public security research, but no mass hardware-tampering campaign against this model was found. Rated Rare rather than Very common for lack of a device-specific public case.
Known vulnerabilities	Very common	—	Long CVE history for the DS-2CD family, including unauthenticated command injection in the web server (CVE-2021-36260, CVSS 9.8) and improper authentication (CVE-2017-7921, CVSS 9.8).
Prior attacks	Very common	—	CVE-2021-36260 is listed in the CISA KEV catalog, i.e. exploitation observed in the wild; Hikvision cameras are also a classic Mirai-family botnet target.
Updatability	Very common	—	Vendor maintains a public security-advisory feed and firmware download portal; firmware is upgradeable via web UI, batch tool or NVR.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	—	Device authenticates to Hik-Connect / NVR platforms with its own credential store; no federated identity or standards-based SSO.
Communications	Encrypted with obselete encryption	—	HTTPS is supported, but plain HTTP/RTSP and legacy TLS configurations remain common in deployments; the web server itself has been the attack surface of CVE-2021-36260.
Storage	No encryption	—	Configuration files store credentials in a recoverable form (CVE-2017-7923); no at-rest encryption of microSD or NVR footage is documented.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	—	Local admin/operator/viewer accounts managed on-device; no central lifecycle management, self-service recovery or role audit.
Authentication	Basic	—	Username/password only, no MFA; the improper-authentication CVE shows the authentication path has been bypassable.
Brute-force protection	Basic	—	Some firmware builds lock accounts after repeated failures, but the behaviour is model and firmware dependent and not documented as a platform guarantee.
Event logging	Partial logging	—	On-device log of logins and alarms exists and can be exported, but coverage is limited and no remote/central audit trail is offered.
Passwords	Require change after setup	—	Since 2015 firmware a unique password must be set at activation; complexity is checked but not uniformly enforced across legacy firmware.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Hikvision embedded Linux firmware (Companion App: Hik-Connect)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage: microSD card slot, NVR/NAS recording
Power, Battery & Charging	Battery: • Power: PoE (802.3af) / 12 VDC • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: RJ-45 10/100 Ethernet (PoE), ONVIF, RTSP
Physical (Dimensions & Mass)	Dimensions: • Mass:

Reasoning: The DS-2CD2143G0-I inherits the security profile of the wider DS-2CD family: a documented history of critical, remotely exploitable web-server and authentication flaws, one of which is exploited in the wild and listed in CISA KEV. Local storage and configuration data are not protected at rest and the device exposes plain HTTP/RTSP by default on many firmware builds. Mitigating factors are a maintained security-advisory process, forced password activation and OTA-capable firmware. Scope note: rating reflects default deployment of a current firmware build; an isolated VLAN with HTTPS/TLS-only access and no internet exposure materially raises the effective rating. Release date is the EasyIP 4.0 series introduction (year-level precision).