Dahua IPC-HFW1200S
From Wiki-IoT
(diff) ← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Dahua IPC-HFW1200S | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Dahua IPC-HFW1200S
Brand: Dahua Category: Security Camera • Model / Gen: IPC-HFW1200S Release Date: 2020-01-01 • Status: In sale Classification Date: 2026-10-21 • [www.dahuasecurity.com/ Official Website] | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | [www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt 🔗 Proof] | No mass physical-tampering campaign; issues are network/remote. |
| Known vulnerabilities | Very common | [vuldb.com/cve/CVE-2024-13131 🔗 Proof] | CVE-2024-13131 (CWE-284): unauthenticated access to /web_caps/webCapsConfig discloses configuration and network data. Also CVE-2024-39944 (unauthenticated packet can crash the device) and a broader Dahua authentication-bypass advisory (JVNDB-2024-000007, CWE-287, CVSS 8.1). |
| Prior attacks | Rare | [www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt 🔗 Proof] | Dahua cameras have been targeted in botnet/credential-stuffing campaigns; no CISA KEV entry for this model. |
| Updatability | Very common | [www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt 🔗 Proof] | Firmware updates released through Dahua's PSIRT and support portal. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | [www.dahuasecurity.com/ 🔗 Proof] | ONVIF, P2P and NVR integration with device credentials; P2P relies on vendor cloud. |
| Communications | Encrypted with obselete encryption | [www.dahuasecurity.com/ 🔗 Proof] | Management interfaces historically used weak/obsolete TLS and unencrypted options. |
| Storage | No encryption | [www.dahuasecurity.com/ 🔗 Proof] | Local SD/edge recordings are not encrypted at rest by default. |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | [www.dahuasecurity.com/ 🔗 Proof] | Local user accounts with limited roles; no rich cloud account management. |
| Authentication | Basic | [jvndb.jvn.jp/ja/contents/2024/JVNDB-2024-000007.html 🔗 Proof] | Authentication-bypass flaws (CWE-287) documented across Dahua products. |
| Brute-force protection | Basic | [www.dahuasecurity.com/ 🔗 Proof] | No documented account lockout policy; default credentials are common in the field. |
| Event logging | Partial logging | [www.dahuasecurity.com/ 🔗 Proof] | Event/motion logging present; authentication events not exposed to users as an audit trail. |
| Passwords | Default/Common/Easy to guess | [www.dahuasecurity.com/ 🔗 Proof] | Dahua devices are widely known for default/common credentials if not changed at setup. |
| Category Score | Score: 3 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Embedded firmware (Companion App: DMSS / gDMSS) |
| Hardware (CPU / GPU) | CPU: Not publicly specified • GPU: N/A |
| Memory & Storage | Memory: Not publicly specified • Storage: microSD / NVR |
| Power, Battery & Charging | Battery: N/A (PoE/wired) • Power: PoE or DC 12V • Charging: N/A |
| Display & Camera | Display: N/A • Camera: 2 MP bullet camera |
| Sound & Connectivity | Sound: N/A • Connectivity: Ethernet (PoE) |
| Physical (Dimensions & Mass) | Dimensions: Not publicly specified • Mass: Not publicly specified |
