| AXIS Bullet Camera (Q1808-LE)
|
|
Security Grade
Calculator v
|
AXIS Q1808-LE Bullet Camera
Release Date: 2024-02-29 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
[1] [2] 🔗 Proof
|
ARTPEC-8 had a physical secure-boot bypass in older 10.9-11.11 firmware; selected 12.11 is outside that range.
|
| Known vulnerabilities
|
Rare
|
[3] 🔗 Proof
|
CVE-2026-6181 affected earlier AXIS OS; its 12.11.13 fix precedes the selected version.
|
| Prior attacks
|
None
|
[4] 🔗 Proof
|
No Q1808-LE-specific field incident established in the reviewed vendor notices; coverage is limited.
|
| Updatability
|
Very common
|
🔗 Proof
|
Q1808-LE has a published software history and a downloadable 12.11.118 LTS image.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
[5] 🔗 Proof
|
Rating assumes certificate-validated integration and mutual EAP-TLS; anonymous access is off.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
TLS 1.2/1.3 capability; rating requires encrypted management and media with plaintext services disabled.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Datasheet specifies AES-XTS-Plain64 256-bit internal filesystem protection; SD/NAS require separate checks.
|
| Category Score
|
Score: 1 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
[6] 🔗 Proof
|
Separate administrator, operator and viewer accounts; account editing and deletion are documented.
|
| Authentication
|
Basic
|
🔗 Proof
|
Login is required, but a physical control-button factory reset does not require the previous credentials.
|
| Brute-force protection
|
Exist
|
[7] 🔗 Proof
|
Documented login-delay/IP-blocking protection is included; it must remain enabled.
|
| Event logging
|
Access event logged
|
[8] 🔗 Proof
|
Access/audit event recording is required for this score; verify logging and retention during installation.
|
| Passwords
|
Require change after setup
|
[9] 🔗 Proof
|
First-use administrator password is mandatory. Optional 12.9+ complexity enforcement is not assumed enabled.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
AXIS OS 12.11.118 (LTS 2026; selected assessment version) (Companion App: Browser device interface; AXIS Device Manager)
|
| Hardware (CPU / GPU)
|
CPU: ARTPEC-8 SoC; deep learning processing unit (DLPU) • GPU:
|
| Memory & Storage
|
Memory: 2048 MB RAM; 8192 MB flash • Storage: microSD/microSDHC/microSDXC; recording to NAS supported
|
| Power, Battery & Charging
|
Battery: • Power: PoE Type 2 Class 4: typical 14.9 W, maximum 25.5 W; Type 3 Class 6: maximum 51 W including PoE-out; 10-28 V DC or 20-24 V AC also supported • Charging:
|
| Display & Camera
|
Display: • Camera: 4/3-inch CMOS; 3712 x 2784 (10 MP) up to 30 fps, or 3840 x 2160 up to 60 fps; 12-48 mm F1.7-4.0 lens; IR up to 100 m
|
| Sound & Connectivity
|
Sound: 3.5 mm microphone/line input; output via speaker pairing • Connectivity: Two Gigabit RJ45 ports, including PoE-out; configurable I/O
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass: 3200 g
|
Assessment scope
Documentary assessment of Q1808-LE, checked 2026-10-23; no physical camera was tested. The selected, vendor-listed firmware is AXIS OS 12.11.118 LTS 2026. The communication/authentication scores describe a deployment using trusted certificates, mutual EAP-TLS, encrypted management and media, no anonymous viewing, and disabled unused plaintext protocols. Login protection and access/audit recording must be enabled and checked. These are explicit assessment conditions, not observations of an installed device. Optional password-complexity enforcement is not credited. Firmware availability does not establish that every disclosed issue is fixed.
- Standard 12-48 mm version. The separate 50-150 mm tele-lens variant and its 120 m IR range are excluded.
- The release-date field uses the dated official announcement (2024-02-29); first retail shipment was not verified.
- Rare is a qualitative rubric judgement, not an estimate of incident frequency. None for prior attacks means no confirmed model-specific incident in this source review, not proof that attacks never occurred.
- The encrypted-storage criterion concerns internal flash. Network recordings and removable media are separate security boundaries.
- Unverified optional specifications, including GPU and commercial status, are left blank.
IDRS calculation
Device ceil((2 + 2 + 1 + 1)/4) = 2; System ceil((1 + 1 + 1)/3) = 1; User Authentication ceil((1 + 2 + 1 + 1 + 2)/5) = 2. GRAS = 5; calculated grade A-. Contributor calculation; administrator approval remains separate.
Sources
