This letter contains latest information about the above mentioned firmware version.

Transcription

1 Frm ST-VS/MKP1 Prduct Management Release Letter Prducts: H.264 Firmware fr CPP4 HD/MP cameras Versin: This letter cntains latest infrmatin abut the abve mentined firmware versin. 1 General This firmware release is a maintenance release based n FW It is an upgrade fr CPP4 based cameras nly. Changes since last release FW are marked in blue. Nte: Due t an internal file system being intrduced since firmware 6.1x and architectural changes theref, an upgrade t firmware 6.20 and higher is nly pssible frm firmware 6.1x versins r higher. Cameras with previus firmware versins belw 6.1x first need t upgrade t firmware 6.1x. 1 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

2 Frm ST-VS/MKP1 Prduct Management Applicable prducts: AUTODOME IP 4000 HD AUTODOME IP 5000 HD AUTODOME IP 5000 IR AUTODOME IP 7000 series DINION HD 1080p DINION HD 1080p HDR DINION HD 720p DINION imager 9000 HD DINION IP bullet 4000 DINION IP bullet 5000 DINION IP 4000 HD DINION IP 5000 HD DINION IP 5000 MP DINION IP starlight 7000 HD EXTEGRA IP dynamic 9000 EXTEGRA IP starlight 9000 FLEXIDOME crner 9000 MP FLEXIDOME HD 1080p FLEXIDOME HD 1080p HDR FLEXIDOME HD 720p Vandal-prf FLEXIDOME HD 1080p Vandal-prf FLEXIDOME HD 1080p HDR Vandal-prf FLEXIDOME HD 720p FLEXIDOME IP panramic 5000 FLEXIDOME IP indr 5000 HD FLEXIDOME IP indr 5000 MP FLEXIDOME IP indr 4000 HD FLEXIDOME IP indr 4000 IR FLEXIDOME IP utdr 4000 HD FLEXIDOME IP utdr 4000 IR FLEXIDOME IP micr 5000 HD FLEXIDOME IP micr 5000 MP FLEXIDOME IP utdr 5000 HD FLEXIDOME IP utdr 5000 MP FLEXIDOME IP micr 2000 HD FLEXIDOME IP micr 2000 IP IP bullet 4000 HD IP bullet 5000 HD IP micr 2000 IP micr 2000 HD MIC IP dynamic 7000 MIC IP starlight 7000 TINYON IP 2000 family (* first intrduced with this release) 2 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

3 Frm ST-VS/MKP1 Prduct Management Nte: All CPP4 devices incrprate a Trusted Platfrm Mdule (TPM) with wn firmware. This TPM hardware and firmware have been enhanced ver time t allw fr additinal security features. Due t security reasns, the firmware r functinality f the TPM cannt be altered in the field. Thus, nt all new security features becme available n devices with lder TPM hardware r firmware revisins. Nte: Since firmware versin 6.30 all cameras are prepared t receive a unique Bsch certificate during prductin, assigned and enrlled by Escrypt LRA. These certificates prve that every device is an riginal Bsch-manufactured and untampered unit. Escrypt is a Bsch-wned cmpany, prviding a public certificate authrity (CA). Enrllment f the certificates in prductin is asynchrnus t this firmware release. 3 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

4 Frm ST-VS/MKP1 Prduct Management New Features Intelligent Streaming enhancements Statistics pages have been added fr live and recrding streams. These prvide guidance fr ptimally adjust bitrate and quality settings, and make judgement n averaging easier in rder t ptimize strage cnsumptin. Intelligent Streaming cnfiguratin parameters in encder prfiles are nw gruped. Highly reliable SD card recrding with life cycle mnitring Industrial SD cards which prvide wear level data can be mnitred fr their health and expected lifetime, prviding much mre reliable SD card recrding. Three vendrs have been tested and qualified: Sny SanDisk Micrn Due t the high dynamic in the SD card market, n direct reference t the mdels is given. Latest Industrial SD cards frm all three vendrs supprt this feature. ONVIF Prfile T is nw supprted Current gain value is visualized in vide preview windw. The ID ut f the best face detectin is attached t the JPEG filename when psted via FTP and als added t the metadata stream t allw searching. SNI supprt has been added t imprve lad-balancing fr clud-based slutins. Security features Sftware Sealing The camera cnfiguratin can be sealed nce it shuld nt be changed anymre. Any change f the sealing status and any change t static cnfiguratin, accidentally r intentinal, will break the seal, creating an alarm message that can be used by the vide management system t launch an apprpriate alarm scenari. All mdificatins affecting the sealing status are lgged separately. Firmware files are nw encrypted. Files received via HTTP uplad are checked fr crrect size. "Secure renegtiatin" is signalled in TLS. In case f certificate user authenticatin, the clck base is re-adjusted, e.g. after battery lss. 4 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

5 Frm ST-VS/MKP1 Prduct Management System Requirements Web Brwsers: Micrsft Internet Explrer 11 r higher Mzilla Firefx DirectX 11 MPEG-ActiveX 6.13 r newer Cnfiguratin Manager 5.52 r newer 5 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

6 Frm ST-VS/MKP1 Prduct Management Restrictins; Knwn Issues User Interface If UAC is set t default in Windws 7, n snapsht r recrding via LIVEPAGE is pssible. Vide and audi may be asynchrnus during replay via Web page. If a VCA cnfiguratin using a rule engine is switched t a VCA cnfiguratin withut using a rule engine, e.g. MOTION+ r IVA default cnfiguratin, the saved cnfiguratin is invalid. Frensic search with this cnfiguratin may lead t undesired search results. In rare cases it may happen that n recrdings can be fund n PC with Windws XP SP2 and IE6. Internet Explrer may stay in status cnnecting n replay page. An update f Internet Explrer is recmmended. In Firefx, n audi is audible n the Audi Settings page. Opera mini fr mbile devices cannt wrk in Intranets because it gets all pages thrugh an pera prxy in the Internet. If there is n Internet cnnectin n cntent is prvided. When changing GUI language, the brwser cache may have t be deleted and the web brwser be reladed befre the language will be selected crrectly. Ggle Chrme requires a plug-in fr displaying TIFF images t prperly shw the reference image. IE10 by default des nt allw snapshts r recrding frm the LIVEPAGE n lcal hard disk until ne f the fllwing actins is perfrmed: - uncheck the bx "Enable Prtected Mde" in internet ptins/security - add the device s IP range t "Lcal intranet" zne - add the device s IP address t the trusted sites - start IE as administratr If an intranet site is pened, IE10 autmatically runs in cmpatibility mde. This leads t a misbehaviur that n timeline is shwn n the PLAYBACK page. Therefre the functin "Display intranet sites in Cmpatibility View" must be disabled. With HTTPS cnnectin in MS IE and VideSDK 5.71 installed, swapping between stream 1 and 2 may cause the watermarking icn fr stream 2 disappear. This may happen nly fr TCP vide streams with infinite I-frame distance and B-frames n. A fix is available since VideSDK 5.71 MR1. Upgrading the firmware t versin 6.10 may require clearing the Web brwser cache t have the new user interface style appear. Fluent decding f buffered.mp4 vide frm camera is strngly dependent n the brwser, Jerky vide may ccur, e.g. with Mzilla Firefx 52.0, which is nt a camera malfunctin. Shutter time values in preview windw might slightly deviate frm runded values selectable frm drpdwn menu. 6 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

7 Frm ST-VS/MKP1 Prduct Management Encding Only H.264 Main Prfile using CABAC is supprted. CAVLC is nt supprted. JPEG always has HD 1080p frmat, althugh stream 1 culd be set t SD (480p). Frame rates in lw light mde might vary and cause bit rate cntrl t prduce higher bit rates than set as maximum. Aspect ratis 16:9 and 4:3 are nt cmbinable. Aspect rati frm stream 1 will lead. With GOP structure set t IBP and IBBP the I-frame distance may nt exactly crrespnd with the set value. Fr stream setting Dual ROI the maximum reslutin f stream 2 is 288p regardless f a higher reslutin selected in the encder prfile. If bit rate is already reaching maximum level due t image cntent t be encded, encder quality regins with setting bject cannt be imprved fr quality anymre and differences will gradually be reduced. Security When using certificates fr mutual authenticatin, it must be ensured that the camera uses a slid and trusted time base. In case the time differs t much frm the actual time, a client might be lcked ut. Then, nly a factry default will recver access t the camera. Underscre character ( _ ) and blank space are nt allwed in cmmn name in certificates. Excessive signing, e.g. due t very shrt vide authenticatin signing interval, may have an impact n TLS cnnectin setup. Client authenticatin is nt wrking using Micrsft Edge as the brwser des nt send any certificate fr client authenticatin, s the camera has nthing t authenticate. Vide authenticatin using SHA hashing mechanisms are nt functinal if n self-signed certificate has been created yet. Opening an HTTPS cnnectin nce is prerequisite. Cameras with security cprcessr versin 3 with an externally applied certificate will fail HTTPS cnnectins requesting SHA256. The restrictin applies t all functins using the private key frm the certificate, including EAP-TLS with client authenticatin TLS-Time with client authenticatin TLS-Syslg with client authenticatin With self-signed certificate, HTTPS is fully functinal. 7 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

8 Frm ST-VS/MKP1 Prduct Management Netwrk QS values are set accrding t grup Vide/Audi/Cntrl fr UDP packets, but fr TCP packets, nly the QS value fr Vide is inserted. IP addresses /30 which include t are reserved fr internal cmmunicatin and must nt be used as device addresses. Prducts withut internal cmmunicatin ignre this restrictin and allw the use f this range. IVA IVA and flw need at least 12.5 frames per secnd vide input frame rate. If IVA r Flw are cnfigured, minimum frame rate f 12.5 must be set in ALC mde. There is nly ne cnfiguratin fr IVA. When analysis type is changed, e.g. frm IVA t IVA Flw, the frmer cnfiguratin is lst. Due t this, it is nt pssible t change the analysis type in a VCA prfile switch. Due t a limitatin f the script language that is used in the backgrund, the delay timer fr event-triggered VCA starts immediately when the cnfiguratin is set. A trigger event during this perid des nt restart the timer. Once the timer has elapsed, peratin is as desired. On devices with VCA FPGA an utging IPv6 cnnectin fails when device is initiatr, e.g. trying t reslve a time server dmain name, Fr 720p cameras, when switched t 1.3MP applicatin mde, IVA des nt wrk. As a result als iae des nt wrk, as IVA is needed fr that. And therefre als User Mde Intelligent AE des nt wrk ptimally (it is using BLC). After firmware upgrade t versin 6.10 the minimum bject size seems being reset when editing 'mtin in field' task. As a prpsed wrkarund check minimum bject size and crrect value as applicable. T dark alarm is nt triggered under nrmal cnditins due t the cameras lw-light capabilities. MOTION+ An alarm recrding cnfigured t be triggered by MOTION+ with masks may nt be peratinal after rebt. Saving MOTION+ cnfiguratin withut any changes recvers frm that. Alternatively masks may nt be used with MOTION+. 8 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

9 Frm ST-VS/MKP1 Prduct Management Recrding LUN size fr lcal recrding via Direct iscsi is limited t 2 TB. VRM versin 2.12 r higher is required. In sme cases frmatting errrs n external iscsi drives may ccur, which might need multiple tries t vercme. In rare cases it may happen that the wner f an iscsi LUN is nt displayed crrectly. Recrding is nt affected, just previus wner remains displayed. If a device had primary and secndary recrding running n SD card and is then added t a VRM system, the blcks used fr primary recrding will nt be re-used, reducing the available recrding space fr the ANR recrding. This can be slved by re-frmatting the SD card. Thrughput limit fr simultaneus recrding and lcal replay at 100% playback speed is: maximum ttal recrding bit rate f 7 Mbps fr external iscsi recrding maximum ttal recrding bit rate f 10 Mbps fr SD card recrding, depending n SD card perfrmance SD card recrding perfrmance is highly dependent n the speed (class) and perfrmance f the SD card. With I-frame-nly recrding and audi als enabled fr recrding, audi will be fragmented r nt audible during replay. Please disable audi recrding in case f I-frame-nly recrding. Numbering f the recrded files n the replay page is nt always cntiguus. If snippets acrss blck brders belng tgether, like pre-alarm and alarm recrding, the snippets becme lgically united and nly the lwer file number is presented in the list. SDXC cards are frmatted t FAT32 file system and nt using the exfat file system as being mandatry fr SDXC standard cmpliance but fully recgnized and accessible. The maximum size f 2TB is als supprted with FAT32, nce SD cards f that size might becme available. FAT32 als increases prtability t ther than Windws platfrms. If a lcal media is exchanged, existing frmer recrdings are nly discvered after rebting the device. Physically remving the lcal strage media while recrding causes the device t rebt. Recrding must be stpped befre remval. Changing audi frmat while audi is being recrded may cause unknwn behaviur f the device and must be avided. 5MP and larger JPEG streaming via RTSP is nly pssible with decders supprting the ONVIF extensins. JPEG streaming via RTSP is based n RFC This RFC nly allws fr a maximum JPEG size f 2048 by With ONVIF, the riginal, larger JPEG headers can als be transmitted via RTP header extensins. Unfrtunately, this nly wrks with decders using these extensins, i.e. it des nt wrk with a standard VLC. After mdifying accunt settings, e.g. FTP server address, t get the changes applied either switching psting ff and n r restarting the device is required. 9 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

10 Frm ST-VS/MKP1 Prduct Management The strage system indicatr status must be ignred during frmatting f an SD card. Frcing the camera int an verlad situatin may cause undesired behaviur and in wrst cases even recrding gaps. It shuld always be ensured that the CPU lad is nt cnsistently arund r at its maximum. This can be achieved by adapting encder settings r aviding t many tasks, e.g. client sessins, in parallel. Spradically ccurring incrrect time zne inf in recrding packets may lead t gaps displayed in the playback timeline. The vide ftage within the gap cannt be replayed but becmes accessible via exprting the affected perid. This may happen with firmware 6.32 belw built 111. Remte recrding is nt wrking with actual firmware n devices running FW 5.5x r lder because f the recently added security features, which impact RCP+ cmmunicatin and passwrd handling. Exprt FTP exprted files which include audi in a frmat ther than AAC must be renamed frm.mp4 t.m4a t allw crrect playback in QuickTime. With JPEG Psting active when device is bting, the first psted JPEG image may be a ncam lg. FTP psting with reslutin 1080p delivers JPEG with size f 1920x1072 pixels due t 16 pixel macrblck bundary f the JPEG encder. If FTP exprt files cntain nly a few frames sme players might nt crrectly replay such a file, r the replay is t quick t recgnize smething. The exprted file is nt crrupt thugh it might seem s. Files exprted using cntinuus FTP backup fr Rec. 2 where stream 2 is set t I-frames nly mde cntain wrng timing infrmatin and play back t fast. FTP exprt file size is always 100 MB if reslutin change ccurred in exprted time span. Getting the file list frm Drpbx may fail if there are t many bjects (files and flders). Limit is apprximately higher than 500 bjects but als dependent n file name length etc. ONVIF cnfrmance When using GetPresets cmmand preset names are nt set fr scene1 t scene6. 10 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

11 Frm ST-VS/MKP1 Prduct Management DIVAR IP 2000 / 5000 Due t its imprved security features, firmware 6.40 is nt fully backward cmpatible with DIVAR IP 2000 and DIVAR IP Upgrading cameras t FW 6.40 withut t-be-released firmware upgrades fr DIVAR IP 2000 and DIVAR IP 5000 may cause cnfiguratin prblems and pssibly stp recrding. DIVAR hybrid / netwrk Cameras running FW 6.40 are nly cmpatible with DIVAR netwrk / hybrid FW and higher. With earlier DIVAR netwrk / hybrid firmware versins, the I-frame distance needs t be adapted t 30 r less. Fixed cameras In case if there is n image displayed after upgrade t new firmware, please re-pwer the camera. Applicable cameras : FLEXIDOME IP INDOOR 5000 FLEXIDOME IP OUTDOOR 5000 FLEXIDOME IP bullet 5000 FLEXIDOME IP INDOOR 4000 FLEXIDOME IP OUTDOOR 4000 DINION IP 4000 HD DINION IP BULLET 4000 HD DINION IP 5000 HD DINION IP BULLET 5000 HD DINION IP 7000 HD If analgue vide utput is switched n, the frame rate f the first stream is limited t 15 fps. With analgue utput enabled and image rtated, the stream 2 reslutin is limited t 720x720 pixels maximum. On DINION IP starlight 7000 HD, running stream 1 with 720p60, stream 2 is limited t SD reslutin running at max. 30 fps. Due t the feature enrichment, panramic and 5MP cameras needed sme adaptatins t free enugh memry t remain functinal: The maximum JPEG quality fr hardware encding has been slightly reduced frm 80 t 75. Sftware-encded JPEGs use a quality f 100. Maximum I-frame distance remains at 60 fps while ther CPP4 cameras have I-frame distance extended t 255 fr full utilizatin f Intelligent Streaming. Camera name stamping rws are limited t 2 instead f f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

12 Frm ST-VS/MKP1 Prduct Management Dme cameras Autpan starts utside f defined range if rientatin is set t Inverted. Tilt up limit is treated as lwer tilt limit if rientatin is set t Inverted. Fr VG5, when Fast Address was changed a rebt is required t activate it. In AUTODOMEs, blanked sectr may trigger a t dark alarm. On AUTODOMEs, privacy masking des nt cver the cmplete cnfigured area if privacy mask is placed t clse t the edge f a scene. Mve the target psitin t the center f the scene befre creating a privacy mask. If LIVEPAGE is refreshed during recrding f Tur A/B n AUTODOMEs the buttn Stp display will falsely display Start recrding but still cntinue tur recrding. After a firmware uplad it may happen that the Privacy Masks and settings frm Installer Menu are set t default. Make sure t check if Privacy Masks and Installer Menu settings are still valid after uplading new firmware. Sme nline help files describe a tracking icn which is nt visible, dcumentatin bslete. Fr ptimal image perfrmance the user is advised nt t turn ff cntrast enhancement during nrmal camera peratin. T imprve Recrded (Guard) tur playback accuracy, Bsch recmmends users recrd turs using the User Interface (UI) instead f using a keybard. In the event that the Recrded (Guard) tur lses psitin accuracy during playback, users shuld re-hme the camera using the Find hme buttn n the Live page. Since firmware 5.90 the camera mdule in AUTODOME 7000 HD receives a different setting that is persistent ver a firmware dwngrade as lder firmware desn t knw f this parameter t revert it. If it is required t dwngrade a RCP CGI cmmand needs t be applied befre r after the dwngrade: CP&paylad=0x ff&num=1 MIC 7000 rientatin can be switched between nrmal and canted. When the user changes rientatin frm nrmal/canted t inverted (r vice versa), MIC 7000 will tilt itself up and ver s that the visr and wiper are n tp. If there is an attached illuminatr this wuld result in the illuminatr hitting the MIC's bdy. T avid this, MIC 7000 will nt allw an rientatin change while the illuminatr is attached. A warning message with Yes/N selectin will be displayed when the user clicks the rientatin radi buttn and the MIC has an illuminatr. On AUTODOME 7000 and MIC 7000 HDR can be selected in the prepsitin mapping but has n effect as it is nt supprted in these mdels. NTCIP requires t have the SNMP prt enabled t becme functinal. As the SNMP prt, amngst thers, has been clsed by default if nt needed due t security imprvements, it must be re-enabled t allw NTCIP t wrk. Scene/VCA prfile may nt be crrectly restred, causing the Sketch buttn t be disabled. 12 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

13 Frm ST-VS/MKP1 Prduct Management Miscellaneus The camera date/time will be set t default (Year 2000) after pwer lss exceeding the buffer perid. It is imprtant t ensure that the date/time is crrect fr recrding. An incrrect date/time setting culd prevent frm crrect recrding. After firmware uplad while daylight saving time checkbx is activated the time zne must be adjusted. After rebt, the system time re-synchrnisatin may be delayed up t 9 secnds fr SNTP respectively up t 14 secnds fr time server prtcl. A printut was added t telnet when sending an failed. A mre detailed printut was added fr the three errr cases 'culd nt cnnect t server', 'authenticatin failed' and 'recipient nt accepted'. AAC audi timestamps fr UDP live vide streams as well as fr recrding streams are based n 90 khz instead f 16 khz t ensure cmpatibility with Vide SDK. AAC audi timestamps fr TCP live vide streams are based n the standard 16 khz timestamps. Standard players shuld cnnect t live vide with AAC audi using TCP. After changing the selectable camera mde via alarm input the switch back t a previus mde desn't wrk anymre. Firmware uplad stps recrding when it fails r is terminated. After dwngrade cnfiguratin integrity cannt be ensured and settings need t be checked r re-cnfigured. Smetimes even a factry default might be required, which is anyway recmmended after a firmware dwngrade. When a cnfiguratin file is laded t an incmpatible camera, e.g. a cnfiguratin file frm a HD camera laded nt a VGA camera, encder settings might becme invalid and need t be re-cnfigured. Uplading a cnfiguratin file frm a different camera platfrm may result in unpredictable behaviur. If it shall be checked if the image is nt frzen, use millisecnds timestamp t verify. Intelligent Defg default is OFF under Lw bitrate scene mde. When cmbining CPU-intensive functins like e.g. encryptin, watermarking, r dual recrding, with high quality and high frame rate encder settings, tuning f encder prfile settings might be required t avid verlad situatins. N time change is allwed during the time when the "hur is repeated". Maintenance lg file creatin and dwnlad requires sme time, thugh there is n prgress indicatin, and needs t be waited fr cmpletin. Millisecnd stamping n 60 fps cameras is refreshed with 30 Hz nly, updating nly every secnd frame. JPEGs with VCA verlay are nt fully synchrnized. Shapes might be slightly ff. Please check the respective release letter f a camera fr further device-specific restrictins. 13 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

14 Frm ST-VS/MKP1 Prduct Management Previus Revisins 6.1 Changes with Cipher suites were enhanced by TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256. An issue with simultaneus multicast streams, intrduced with FW 6.43, has been fixed. An issue with ONVIF SetImageSettings, where incrrect settings culd be applied when an unsupprted namespace was used, has been fixed. An issue with ONVIF IVA messages suspended, when mre than ne IVA rule was cnfigured, has been fixed. An issue with VCA calibratin lst after image rtatin has been fixed. An issue with EAP-TLS certificates with CRL extensin, intermittently prhibiting authenticatin, has been fixed. An issue with panramic cameras, where pre-psitins culd nt be set in the web interface when in n-bard dewarping mde, has been fixed. Varius smaller issues have been fixed. 6.2 New Features with ITS versins f AUTODOME and MIC cameras can be enabled t allw NTCIP prtcl ver serial interface. A pssibility t increase the Pwer-ver-Ethernet (PE) demand signalled via LLDP has been added. This may help t ptimize the pwer management n switches and e.g. als eases t use the cameras in utdr husings with PE-pwered heating systems. IGMP versin can nw be set t a specific versin. Autmatic detectin is still default. 6.3 Changes with Imprvements n Multipathing supprt fr strage devices. Varius smaller issues have been fixed. 14 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

15 Frm ST-VS/MKP1 Prduct Management Changes with Strnger user name and passwrd plicy is enfrced. The fllwing rules apply: User names must be at least five (5) characters lng. User name and passwrd must nt be identical. A passwrd must cnsist f minimum eight (8) characters. A passwrd must cntain bth upper-case and lwer-case letters. A passwrd must include ne r mre numerical digits. A passwrd must include at least ne f these special characters:!? " # $ % ( ) { } [ ] * + - =., ; ^ _ ~ \ Other special characters (like : < > ' & etc.) are nt supprted. Multicast discvery prt is nw cnfigurable via brwser interface. An issue where spradically n vide was shwn after pwer cycle has been fixed. An issue where Autmatic Netwrk Replenishment ANR failed when SD card is brken has been fixed. Imprved behaviural respnse n denial f service attacks. Varius ONVIF cmmunicatin issues have been fixed. Varius smaller issues have been fixed. 6.5 Changes with FW MIC 7000 nly: Rbustness enhancement fr the psitin feedback lgic. This enhancement makes sure that varius prblems that culd ccur when specific peratins were used in cmbinatin with specific cmmand inputs are fixed. This enhancement applies t the fllwing peratins: Abslute Psitin, Privacy Masks, Aut-pivt, Saving Prepsitins, Sectr Titles, Azimuth/Elevatin, and Cmpass. AUTODOME IP 7000 series and MIC IP 7000 series nise reductin imprved fr lw-light cnditins. Varius smaller issues have been fixed. 15 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

16 Frm ST-VS/MKP1 Prduct Management New Features with FW Intelligent Streaming Intelligent Streaming is a cmbinatin f features and functins t ptimize bitrate cnsumptin f recrded vide. It benefits frm imprved nise reductin in still areas f the image, an average nise level cmmunicated t the encder, larger GOP size, strng use f predictin in case f B slices, and dynamic tuning f quantizatin parameters (QP) in the encder. The strength f the bitrate ptimizatin can be set via 5 levels. Savings can be up t 80% but are strngly scene-dependent. Intelligent Streaming is disabled by default. Sme scene settings and nise cnditins may cause the bitrate t rise when enabled, s cnditins need t be checked t ensure bitrate savings. Security Passwrd enfrcement New cameras with this firmware installed will nly becme perable after the passwrd fr the administratin level (user service ) has been assigned. Other users user and live will nly becme accessible after the administratr assigned passwrds t them. Cameras which are updated t this firmware frm a versin lwer than 6.40 will nt change their behaviur and remain at their frmer prtectin level unless reset t factry defaults. Signed firmware file enfrcement Only Bsch-signed firmware will be accepted by the camera withut cmprmises. A dwngrade t a nn-signed firmware is nt pssible anymre. Data encryptin n iscsi strages The paylad n an iscsi drive is encrypted using a symmetric XTS encryptin scheme (blck encryptin). The camera uses a number f public keys t asymmetrically encrypt the XTS key fr multiple receivers. These public keys are maintained in the certificate stre via certificates. Usage can be defined as fr recrding1 and/r recrding2. Paylad encryptin is pssible n SD cards as well as n external iscsi strage. A client that shall be allwed t replay this ftage must have its cert/key registered and activated. The Vide Recrding Manager (VRM) may als be a receiver t decrypt the paylad data fr replay. SRTP paylad encryptin fr live and replay SRTP prvides paylad encryptin f UDP streams via TLS, similar t what HTTPS des by using TLS fr TCP streams. Als encrypted multicast cnnectins are pssible. SNMPv3 supprt 16 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

17 Frm ST-VS/MKP1 Prduct Management New alternative SNMP supprt prvides encryptin and authenticatin. This new service will prvide pure MIB-II access. Legacy functins, like NTCIP supprt r mapping f dedicated RCP cmmands t SNMP Enterprise MIB ndes, are nly prvided with existing SNMPv1 implementatin. Certificate revcatin list (CRL) supprt T imprve usability and prvide a mre cmpact verview, the web user interface fr the certificate stre has been updated. It nw allws direct tagging f certificates fr usages. The frmer split int tw areas (Files and Usage) is remved. Strnger encryptin and passwrd prtectin fr cnfiguratin file The cnfiguratin file is encrypted and passwrd-prtected befre dwnlad. The user as the wner f this cnfiguratin file is prmpted fr the passwrd. The passwrd is required when the cnfiguratin file is upladed t a camera. The cnfiguratin file is encrypted using standard mechanisms but nt intended t be pened r mdified by the user, thus the encryptin key itself is kept internal and nt expsed. Strnger encryptin fr maintenance lg file The maintenance lg file as being used in tech supprt cases is encrypted with a Bsch public key. Only tech supprt staff is authrized t decrypt and pen the file. The minimum TLS versin can be defined, e.g. t avid vulnerabilities frm TLS 1.0 and 1.1. The Telnet cnsle has been cmpletely remved and is substituted by a new lgging facility prviding: A mre structured utput including timestamp, severity and mdule surces Search and filtering fr specific events via web user interface Direct utput t a syslg server Cnfiguratin t prduce similar debug printuts fr tech supprt as previusly Cnslidatin f running services, visualized n new page Netwrk Services. Only thse services (HTTP, HTTPS, RTSP, RCP, iscsi, NTP, discvery, ONVIF discvery) are running which are required fr activated functinality. All ther services (FTP, SNMP, UPnP, GB/T 28181) and their respective prts are deactivated. The passwrd unlck functinality (supprt recvery ptin) can be disabled. CHAVE cameras Multiple trusted issuers are nw allwed fr client certificate authenticatin. An ptin t nt wipe the SXI certificate when a factry default is issued has been added. Imaging Imprved nise filtering in still scenes. 17 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

18 Frm ST-VS/MKP1 Prduct Management VCA Fr details n VCA 6.40 please refer t the separate release ntes f Essential Vide Analytics r Intelligent Vide Analytics. ONVIF ONVIF manual iris and fcus cntrls added. Feature cverage f the ONVIF metadata stream has been extended t include e.g. bject classes, bject shape plygns, faces, flame and smke detectin inf. Prfile G supprt Recrding start and cntrl has been added. Recrding search and replay functinality has been added. Tested with ONVIF Device Test Tl SR2 rev Miscellaneus SMTP prt is nw cnfigurable via web interface. Multipathing supprt fr strage devices. User name frm certificate fr EAP-TLS is used as EAP identity, if prvided. Dynamically clred privacy masks, depending n surrunding vide added. This can be used t nt distract the peratr due t intense clr, e.g. white privacy mask in night scene. Cameras can cnnect t the CBS Remte Prtal installer service. New illuminatrs fr MIC 7000 are supprted. An event playback buttn has been added t the Live page t allw a quick playback f the last event in case there was an incident and the camera was cnnected remtely t check what happened instead f checking live and then g t the playback page. Default device date is set t firmware build time in case f invalid RTC time t avid lck-ut in case f certificate-based authenticatin. Drpbx API has been updated. The API used befre was ging bslete n June 28 th, Changes with FW Cmpass indicatr mved twards center t appear als in 4:3 reslutins. Installatin Cde has been enhanced with a blck fr crypt-cprcessr versin indicatrs. The length f the Installatin Cde has been extended t 48 digits instead f nly 44 digits. Imprved certificate parser t supprt mre attributes used e.g. by varius mail prviders. 18 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

19 Frm ST-VS/MKP1 Prduct Management New Features with FW Imaging Lens settings Near Fcus Limits fr day and night have been added. Sectrs in dme cameras can be mre flexible set t 4, 8, 12 r 16 (default). Security Strengthened passwrd plicy: New passwrds must nw be a minimum f 8 characters including special characters. Passwrds are cntinuusly demanded; message cannt be hidden anymre. Fr full supprt f HSTS, an ptin HSTS plus HTTP redirectin has been added. Fallback t TLS 1.0 can be disabled. VCA JPEG with VCA verlay is nw als available in full screen view. Fr details n VCA 6.30 please refer t the release ntes f Essential Vide Analytics r Intelligent Vide Analytics. Miscellaneus Imprved user interface fr 802.1x settings. Interface shws an EAP-MD5 passwrd field and lists the EAP-TLS certificates with a link t the certificate stre. Security cprcessr (TPM) versin is listed in system verview. Aux and prepsitin widgets n Live page can be cmpletely disabled in Web appearance settings. New capability cluster grup has been intrduced. MIC integratrs can get the audi back channel capability n VIDEOJET cnnect 7000 frm this cluster grup. AUTODOME 7000 Msaic privacy masks are supprted in AUTODOME IP 7000 series. 19 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

20 Frm ST-VS/MKP1 Prduct Management Changes with FW Limited frame rate stream capability names are presenting the frame rate as skip value, which is used as divisr in relatin t the base frame rate. A value skip 5 results e.g. in 12 fps if base frame rate is set t 60 fps, r in 5 fps if base frame rate is set t 25 fps. In preparatin fr ONVIF Prfile Q supprt, planned fr next majr firmware release, the default setting fr Autmatic IPv4 address assignment has changed frm On t On plus Link-Lcal, a setting that had already been in the ptin list befre. Thugh this might seem a small change, it may have an impact: The frmer default IP address will virtually becme bslete. Instead, the camera will assign itself an aut-ip address ut f the range t as lng as there is n ther IP address assigned by a DHCP server. ( The advantage is that there are n mre duplicate IP addresses, which is cnsidered prhibited in a netwrk. VCA verlays are drawn after scaling t imprve visibility. An issue has been fixed where the maintenance lg culd nt be dwnladed. An issue has been fixed where the wrng SD card recrding status was displayed. A security leak, which allwed t extract critical data frm the device, has been fixed. A prblem with incrrect time zne inf in recrding packets causing gaps in timeline has been fixed. 20 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

21 Frm ST-VS/MKP1 Prduct Management New Features with FW Imaging A 1.3 MP applicatin variant is nw selectable fr DINION IP bullet 4000 cameras. Security The user management has been extended t allw free assignment f usernames. Each user can be assigned a user grup representing live, user, r service level. New user management system allws t dynamically create a user fr whm the passwrd can be treated as tken. Als timeut befre user accunt expires is pssible. Tken-based authenticatin implemented t allw user management based n cmmunicatin with Micrsft Active Directry Federatin Services. Secure FTP cnnectin (FTP ver TLS) is implemented. ICMP redirect messages are nt accepted anymre by default. Acceptance can be re-enabled via RCP+ cmmand, if needed. Vide authenticatin is nw als pssible n RTSP streaming. It can be enabled with CGI parameter auth=1 which requests picture inf packets (paylad type 97). Recrding Recrding t iscsi nw supprts LUN size up t 64 TB. A PTZ prepsitin can be stred in a recrding prfile, allwing t recrd nly a regin f interest (ROI) f the full image. ONVIF ONVIF encder prfile settings can be verified via Manual fcus and iris cntrl is nw supprted via ONVIF cmmand. Tamper detectin alarms are nw frwarded t and included in ONVIF event services. 21 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

22 Frm ST-VS/MKP1 Prduct Management VCA Web page layut has been imprved fr better usability and larger vide fr cnfiguratin. Vide analytics nw fully supprt 16 tasks in RCP+ and IVA Task Script Language. JPEGs can nw include VCA verlays in Live page, alarm s and JPEG Psting. Fr JPEG snapsht a new query parameter VCAOverlay can be added t the URL, e.g. Vide can nw be paused during VCA cnfiguratin. Reference image is nw stred as JPEG instead f TIFF fr brader cmpatibility. Tamper detectin t bright / t dark was n mre functinal due t t high dynamic n ur cameras. T slve this issue, sliders fr the brightness level have been added fr manual adjustment. Fr details n VCA please refer t the release ntes f Essential Vide Analytics r Intelligent Vide Analytics. Miscellaneus HTML5 vide tag is used t display a cntinuus MP4 vide file frm the camera n brwsers nt supprting NPAPI plug-ins (MPEG-ActiveX) like Firefx, Chrme and MS Edge. A Links sectin in the main navigatin (blue tp bar) has been added, leading t a DwnladStre page prviding latest tls, apps and supprtive sftware. Unicde characters are nw als pssible n all cnfiguratin strings. Time server IP address can be accepted t be verwritten by DHCP. Display f prepsitin widget n Live page can be cnfigured. MIC washer has been added t preset mapping functins Changes with FW Image t nisy is remved as it never ccurs due t the high dynamic f image prcessing. Dwnscaled images 4CIF/CIF are nw encded as PAL reslutin (704x576 resp. 352x288) when camera is set t 25/50 fps base frame rate. Fixed a ptential recrding issue which culd cause recrding t stp due t insufficient strage errr handling under rare errr cnditins, like e.g. massive irregular netwrk cnnectin interrupts t strage system. Fixed an issue in ONVIF signaling f SD reslutin. 22 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

23 Frm ST-VS/MKP1 Prduct Management Changes with Supprt f new camera mdules in AUTODOME 7000 and MIC 7000, prviding imprved nise reductin. A high-reslutin/limited-frame-rate capability has been intrduced fr stream 2 n varius cameras Changes with Writing t ONVIF MaxFrameRate is nw pssible t imprve cmpatibility with clients nt using encding interval. Written values are presented in same frmat when read Changes with An issue with increased nise and theref increased bit rate frm AUTODOME and MIC cameras has been fixed. Aut Fcus accurateness n DINION IP bullet 4000 and DINION IP bullet 5000 has been imprved. An issue with fragmented EAP-TLS transfer has been fixed, allwing supprt fr Micrsft Windws NPS and RADIUS. An issue with ONVIF Analytics Service has been fixed. GUI translatins and sme embedded help files have been updated. An issue with analgue utput flickering n DINION IP starlight 7000 and FLEXIDOME IP starlight 7000 in 1.3 MP mde has been fixed. Wrng wrding n time prtcl settings has been fixed. 23 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

24 Frm ST-VS/MKP1 Prduct Management New Features with Cameras Supprt fr DINION IP bullet 4000 and DINION IP bullet Dme and AUX functins can be mapped t presets. MIC-7000 audi back-channel supprt twards VJC-7000 audi utput n LIVE page. Security Supprt f TLS 1.2 with updated cypher suites including AES 256 encryptin. Device access security has been imprved by: Implementatin f signed time synchrnizatin Signature-prtected passwrd unlck prcedure Telnet ver HTML5 web sckets in brwser, using secure TLS cnnectin Thrttling f wrng passwrd entries Urging user twards setting a device passwrd, strength meter prvided Firmware, which is signed with a private certificate, is authenticated befre transfer t Flash t ensure a secure firmware uplad. Certificate handling has been enhanced by: Aut-generatin f self-signed certificates fr SSL User-defined creatin f self-signed certificates Pssible uplad f certificates with encrypted private keys Imprved recrded vide authenticatin withut PKI required Strage and retrieval f certificate in recrding fr verifying signed vide Web GUI security has been imprved t prevent Crss-Site-Scripting in Brwser. Use f secure cnnectins can be advertised via supprt f HSTS. 24 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

25 Frm ST-VS/MKP1 Prduct Management Changes with bit encryptin disabled fr secure cnnectins t increase minimum security level. Telnet service (system cnsle) is nw disabled by default. DHCP ptin 12 has been changed t send Renew message including the camera name as hstname New Features with Adding imprved AF speed fr AVF cameras Changes with Adding small imprvements and errr crrectins. ONVIF analytics capabilities have been crrected fr dme cameras. Replay nt wrking in BVC and BVMS clients fr negative time znes has been fixed. 25 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

26 Frm ST-VS/MKP1 Prduct Management New Features with New Graphical User Interface Light and friendly Web brwser interface fllwing the Bsch Security Systems style guide fr sftware interfaces. Usability imprvements due t clearer structure and elements. Live preview during cnfiguratin wherever pssible due t space. Turs re-arranged nt single page and scheduler fr preset tur and alarm rules added fr mving cameras. Encder quality regins can be cnfigured n mving cameras preset psitins with up t 8 regins. Vide exprt frmat can be preselected frm Bsch frmat including metadata and generic MP4 frmat n LIVE page. Imaging Enhancements Digital Zm mde added t lens settings page. Setting migratin keeps all the previus imaging settings after camera upgraded t new firmware. Please nte: This is nly applicable after firmware Security Enhancements Certificate Stre fr management and assignment f client and server side certificates. Preparatin fr Public Key Infrastructure (PKI), enabled via special license, has been added. 56-Bit DES cipher suite is disabled fr TLS cnnectin. IVA Enhancements Object classificatin f bject types upright persn, bike, car, truck replaces head detectin. Gelcatin allws setting a camera s glbal crdinates. The psitin f the tracked bjects in the respective crdinate system is added t metadata. Camera viewers can shw the tracked bjects n a map. Usability imprvements allw fr easier calibratin and easier drawing f elements and masks. MOTION+ cnfiguratin has been rewrked. Eight MOTION+ alarm fields with up t 16 ndes can nw be set. Areas can be remved frm prcessing via VCA masks, which will then suppress metadata generatin in these areas. Nte: Fr details and cmplete verview refer t release ntes f IVA f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany

27 Frm ST-VS/MKP1 Prduct Management ONVIF Enhancements IVA events can be received via ONVIF messages. Overlay metadata can be received in ONVIF XML frmat. AUX cmmands can be sent via ONVIF messages. Special functins like IR Crrectin, Visible White Light and Anti-Fg fr MIC 7000 can be sent via ONVIF messages. Intelligent Tracking fr AUTODOME and MIC can be enabled via ONVIF messages. Cnfrmance was tested using recent ONVIF test tl Miscellaneus Missing time znes added fr Caracas, Newfundland, Kathmandu, Yangn, Sama and Kiritimati Island. 3 rd party prtcl supprt can be enabled via special license, shwing specific menu when license is installed. Internal strage can be disabled and hidden via special license fr certain LATAM cuntries. This license can nly be cleared via technical service and supprt. An additinal area in the flash memry, hlding a file system t stre specific files r data, has been implemented. This area can hld such like the enhanced Chinese character table r the FPGA image fr IVA cameras running in 5:4 setup, certificates r cnfiguratin data. With FW 6.10 necessary files can be installed by uplading a supplementary firmware file. Fr successive firmware versins the sectins will be recmbined. Besides nrmal POE+ pwer signalling, with a special license installed the available pwer can be signalled prprietarily. Signalled pwer can be cnfigured manually when license is installed. A custmer lg up t 128x128 pixels with a depth f 256 clrs can be upladed as BMP file t be displayed in the camera name blck. Optins fr placement are left, right r lg nly Changes with IPv6 peratinal imprvements, e.g. netmask extended t 64 bit. Reference image is deleted when device is set t factry default. Imprved rbustness f encding DSP. Fix fr JPEG reslutin handling n AUTODOME IP Fix fr recrding status while pre-alarm recrding in RAM. 27 f 27 BOSCH and the symbl are registered trademarks f Rbert Bsch GmbH, Germany