BVMS - compatibility with security enhanced camera firmware versions (FW 7.87, 8.90, 9.00 or later)

Possible causes and solution(s)

• Symptoms

Maintaining the highest level of data security requires continuous improvements in all the system components - including software and device firmware. Recent changes in the camera firmware are focused on improving the security level overall.

However, it might cause some troubles when such cameras are connected to the previous BVMS releases. The potential symptoms are:

• no possibility to add the camera to BVMS

• no communication with the camera with unsecure connection (using HTTP or RCP+)

• no communication with the camera using secured, HTTPS connection

Those symptoms might be caused by various changes in the firmware, explained below.

• Causes

1) Legacy RCP+ commands received a higher authentication level in the camera firmware

Within the camera firmware changes were implemented, so that legacy RCP+ commands received a higher authentication level to further reduce the attack surface and improve security by default. Those changes might make it impossible to add a new camera to the BVMS.

Changes introduced with:

2) Unsecured ports and services disabled in the camera

As best practice to reduce potential attack surfaces and limit the exposure of sensitive services the following ports are disabled in the camera by default:
RCP+: CONF_RCP_SERVER_PORT 
HTTP: CONF_LOCAL_HTTP_PORT 
RTSP: CONF_RTSP_PORT 
iSCSI: CONF_ISCSI_PORT

Closed RCP+ port in the camera might not allow adding this camera to the BVMS, as it was used in the earlier versions

If camera is added to the system with Secured connection option disabled in the BVMS configuration (so it's using unsecured ports for the communication),

Changes introduced with:

*An unsecured connection is required for local storage replay, such as e.g. SD card, ANR. Communication over the RCP+ and iSCSI port is required in such a scenario. While communicating to the device on a secure connection, these ports can be re-enabled. A reboot of the device is required after re-enabling these ports, and then one can switch back to using an unsecure connection.

3) New firmware libraries with the limited backwards compatibility

The new libraries in the firmware, used for secured (HTTPS) communication are not compatible anymore with BVMS 11.1.1 or older. As a result, if secured communication is configured, camera will not function properly in BVMS anymore.

Changes introduced in:

• Solution

Please find the overview of applicable BVMS patches for supported BVMS versions

BVMS 11.0 or previous versions

Since the mentioned FW versions were released more than 2 years after BVMS 11.0 release, compatibility cannot be guaranteed. In order to use the latest camera FW versions with BVMS, please consider upgrading BVMS to one of the versions mentioned above.

 Nice to know:

• Bosch Video support - Firmware and Software requests