About Central_Support

Possible causes and solution(s)   Symptoms   During the BVMS upgrade from v11.1.1 to v12.0 through System Manager v2.0 on the DIVAR IP 6000 AIO, the software file placed on an external drive is not visible to be installed. What could be the cause?   Possible Reasons:   Folder structure on the USB media is not correct. The folders were not copied to the correct system partition (do not use C: / Desktop)   Solution   To be automatically detected by the Software Selection screen, the DIVAR IP System Manager installation file SystemManager_x64_2.0.0.exe must be located in a folder with the following structure: Drive root\BoschAppliance\ (for example F: \BoschAppliance\ of an attached USB drive)   ⚠️ Important: Drive C: and Data drive(s) shall not be used for this purpose.   BVMS upgrade to v12.0      In order to upgrade BVMS to version 12.0 on DIVAR, please refer to the document below: https://downloadstore.boschsecurity.com/FILES/Release_Notes_DIVAR_IP_System_Manager_2.0.0.pdf and Page 35 from: https://resources-boschsecurity-cdn.azureedge.net/public/documents/DIPaio6000_Installation_Manual_enUS_101032749707.pdf    Or you can try to perform the software upgrade by using the BVMS 12.0.0 System Manager package 1.0. Download the BVMS 12.0.0 System Manager package 1.0 and save it to a storage medium such as a USB stick. Unzip the files on the storage medium. Do not change the folder structure of the unzipped files. Connect the storage medium to your DIVAR IP all-in-one system and follow Initial system setup and choosing operation mode or Upgrading software instructions in the DIVAR IP all in-one 4000 / 6000 systems Installation Manuals and User Manuals, and in the Application Note "DIVAR IP all‑in‑one Remote Portal connectivity".    Good to know: Please be aware that if you have installed hard drives to an empty unit, you first must configure them before performing the initial setup. Before selecting and installing the Operation Mode on you DIVAR IP 44xx and 64xx AIO units, please be sure that: you have physically installed the HDD into the unit correctly you have properly done the RAID configuration (applicable for DIP 64xx unit) recover the unit For DIVAR IP all‑in‑one 6000 Installing the hard drive, page 28 Configuring RAID5, page 38 Recovering the unit, page 39  For DIVAR IP all‑in‑one 4000 Installing the hard drive, page 19 Recovering the unit, page 31   💡 See other useful KB articles: DIVAR IP AIO 4000 & 6000: Recovery to factory defaults & BVMS operation mode via System Manager How to upgrade BVMS from version 10.1 to version 12.0.0/ 12.0.1 on DIVAR IP 7000 AIO gen3?   ... View more

Question   Why are the old recordings not removed after setting the retention time (DIVAR Hybrid or Network)?   Answer   Note that the recordings are not removed instantly. The recordings will be deleted on the next day at 12:00 AM, after the automatic delete is changed. On the next day, you will notice that the old recordings will be deleted and only the defined days of recording will be shown on the timeline.   This example is with "Automatically delete old fields" option set as "Customized" & "5 days". This option was set 1 day before the timeline removed the old recordings:   The following article guide describes how to adjust the automatically deleting time of recordings: How to set maximum retention time on DIVAR Network models? (boschsecurity.com) ... View more

📚 Overview: 1. Introduction 2. New secure default settings 2.1. What is the immediate impact of this? 2.2. How do default settings work in Bosch IP cameras? 2.3. How can the settings be reverted? 2.4 How can negative impact be avoided? 2.5. Why are other ports still open?         1. Introduction   At Bosch, we were always aiming for best possible security of our IP cameras as well as other devices and solutions. Numerous documents, like security-related tech notes as well as a hardening guide, our Data Security Guidebook, had been created, published, and marketed to create the necessary education and awareness. Since security features are evolutionary advancements that are not immediately applied to and usable in existing installations, remaining backward compatible with new firmware releases and cameras was long considered more important than achieving the best security by default. With increasing demand for better default security, in accordance with our security certifications, and with more and more systems having evolved into using increased security measures, now is the time to finally do the switch to stronger default settings and not only rely on education and documentation.   2. New secure default settings   Bosch will undertake a cybersecurity best practice by disabling certain ports on the camera by default. This best practice is being undertaken to reduce potential attack surfaces and limit the exposure of sensitive services, as mentioned in our Data Security Guidebook since years. This new secure default behavior will be standard with new firmware releases as mentioned below, applies to cameras that are produced with these firmware versions, and will also apply to all cameras that are being upgraded in the field to one of these or future firmware versions. Platform Firmware version Expected release date CPP14 9.0 October 2023 CPP13 8.90 July 2023 CPP7.3, CPP7, CPP6 7.88 December 2023   The following ports will be disabled by default: RCP+ ports 1756 HTTP port 80 RTSP port 554 ISCSI Server port 3260   2.1. What is the immediate impact of this?   RCP+ is the native communication interface to the camera. On a secured camera, this protocol needs to go through an HTTPS tunnel. Most web browsers have moved to use HTTPS instead of HTTP for initially connecting to URLs, so the impact of closing the HTTP port is considered irrelevant for browser applications. For installations that use HTTP as the main communication protocol, though, this may have a major impact since communication to the cameras from a VMS using default HTTP settings is interrupted. Modern video decoders and viewers provide means of using secure RTSP connections but need to be configured to do so. If solely relying on RTSP, such clients will not receive video anymore. Bosch IP cameras provide a possibility to expose their local storage medium as an iSCSI drive. Access to local storage is not possible anymore, and as a result, direct iSCSI replay is not functional anymore as well.   2.2. How do default settings work in Bosch IP cameras?   If configuration settings have not been changed or touched, their values remain at their default states. Such settings will receive the new default values with the firmware update and immediately assume the new behavior. A setting that had been modified, or even overwritten with the same value, is considered a changed value, intentionally set, and thus not considered default anymore. Such settings will not be affected when the default values are changed by a firmware update. New default values would then only apply to these settings after a factory reset. The RCP+ port 1756 is typically not changed to another port, or disabled and re-enabled, so will most likely remain at its default. Thus, if never being changed, it will receive its new default, being switched off. HTTP is typically used with port 80, so will most likely also remain at its default. Thus, if never being changed, it will receive its new default, being switched off. RTSP is typically used with port 554, with no need to be changed or switched off, so will most likely also remain at its default. Thus, if never being changed, it will receive its new default, being switched off. The iSCSI server is typically used with port 3260, with no need to be changed or switched off, so will most likely also remain at its default. Thus, if never being changed, it will receive its new default, being switched off. A camera that is used out of the box without changing anything, which is likely due to the effort we spent on making the camera’s default values the most appropriate for standard use cases, will see the full effect from the changed security defaults.   2.3. How can the settings be reverted?   Quite easily, the closed-off ports can be re-enabled through: the camera webpage, using HTTPS in the browser, the Bosch Configuration Manager, using HTTPS as the selected communication protocol, an RCP+ integration in a video management system, using a secure tunnel with RCP-via-HTTPS. Re-enabling the ports is considered an intentional configuration and will remain during future firmware updates until a factory reset.   Note:    Reverting the port closure lowers the security level of the system and shall only be considered if there is no way to improve the overall security settings of the system. Take it as a chance to improve security where possible.   2.4 How can negative impact be avoided?   Wherever possible, security measures should be in place to a necessary extend before the firmware is updated. With video management systems that support secure connections, they should be configured to make use of that before the cameras are updated with one of the secured firmware versions. Where this is not possible, it could make sense to update in smaller batches, then re-configure the cameras to have them working again in the non-secure environment to keep downtimes of the surveillance system low and partial. A web browser cache might need to be cleared, especially if the browser “learned” to use HTTP to a camera instead of trying HTTPS first.   2.5. Why are other ports still open?   The discovery ports are kept open to allow configuration tools to detect the device on the network. These two ports do not provide an attack surface due to their limited purpose, and do not need to be closed. The NTP server port and the Ping response (ICMP) also have limited purpose and do not provide an attack surface, so do not need to be closed. The password reset mechanism is a service using a browser connection, now secure, that does not use an own port. Client connections going out of the camera may open their required ports. These are using services on other servers or devices but do not provide attackable services themselves. The configuration of a Bosch IP camera comes with default settings that evolved over the years to reflect the best practice settings for standard applications ... View more

Introduction   The new INT-TXO Integrus Transmitter integrates the Integrus system in the DICENTIS via OMNEO. Old Radiators and Receivers stay the same and existing equipment can be used in the DICENTIS now with the new INT-TXO transmitter. It is usable from software version 4.20 onward and is made for DICENTIS only usage at the moment. But it will be open up in future for the usage of 3rd party devices which than are planned to be managed with the Dante Controller software. Please visit our product page for more information.  Product page https://commerce.boschsecurity.com/us/en/Transmitter-OMNEO/p/F.01U.351.763/ Data sheet https://resources-boschsecurity-cdn.azureedge.net/public/documents/INT_TXO_Data_sheet_enUS_100901167499.pdf Softwarehttps://licensing.boschsecurity.com/software/html/pages/home/ Manual https://resources-boschsecurity-cdn.azureedge.net/public/documents/INTEGRUS_Operation_Manual_enUS_100901175819.pdf   Front   Back   Overview of the new Integrus system:     Overview of the old system designed for the usage of DCN-NG or to use as stand alone system:     How to setup   First install the INT-TXO into an rack and and insert the power. The preferred way to power the TXO is to use an DCNM-APS or PS because you than can switch it completely off and on with your DICENTIS software. If you use an POE port from an switch or the included external power supply it will switch only into standby mode if you turn the DICENTIS system off. Which free network port you are using to connect anywhere in the DICENTIS cloud is not important. The device behaves (is) similar to an two port switch like every DICENTIS devise which makes it very flexible were you can connect it and daisy chain. For that it provides an wide cable range of 100m between each DICENTIS unit. (Ethernet specification IEEE 802.3ab)   Accessories   The TXO comes with an external PSU the same as for the DCNM-WAP with universal AC adapters for different country's. Output 48V 0,5A 24W + standard rack mounting brackets.   Connection Expel   The INT-TXO can be connected to any point in the DICENTIS cloud for example to a DCNM-Idesk, DCNM-MMD or directly to an DCNM-PS and it's only limiting factors are hop counts (if RSTP is used) and 11W  Power consumption which must calculated like before with any other DICENTIS device. An power calculation tool is provided within our DICENTIS software to help you to calculate your system easily. https://licensing.boschsecurity.com/software/html/pages/home/   DICENTIS Power Calculation Tool can be found in our Software under Tools.   Power switch   If you use power insert via the DCNM-APS or PS you can switch the TXO completely OFF an ON with the DICENTIS Meeting Application.   In this case the unit will be totally off without power consumption.   But if you use an POE or PSU to power the INT-TXO it will only change into standby mode.   This is the LED indication table to check if an error occurred or if your settings are correct.   The second step is to check the status if the TXO has the right firmware version. If not please do an firmware upload to your version but at least to 4.20. (Please use the newest version >5.1 to benefit of improvements bug fixes) The Minimum DICENTIS Software requirement is 4.20 or else the TXO will not work. The DICENTIS software iso which include the Firmware Upload Tool can be found here. https://licensing.boschsecurity.com/software/html/pages/home/ Next open an browser and type in https://int-txo.local/ All settings are done via this web page.   Login     Flip the the Master Slave switch two times.   Start you registration and set you password.   Press Login   You are now logged in and have access to other menu parts to configure the TXO.   Transmitter status   Here you can check the Presence of Radiators and initiate an test tone which can be checked for example on the receivers.   In this example I only have attached one Radiator and using it as Master.   HF Out   Select Test tone to all.   Now take your LBB4540/xx with an Headset (LBB3443) and switch it on. You should now hear an sinus tone which is increasing in frequency form 0 to 3. 0 is the floor and 1 2 3 are the usable languages. The INT-TOX is in the basic version only with 4 channels of IN- and OUT- puts provided. Additional language channels can be bought with an license.   It is possible to check the signal strength with the LBB4540/xx from the radiators.     or more details please have a look at the Integrus manual which comes with the new 4.20 SW how to configure it. https://licensing.boschsecurity.com/software/html/pages/home/ https://resources-boschsecurity-cdn.azureedge.net/public/documents/INTEGRUS_Operation_Manual_enUS_100901175819.pdf   All manuals regarding the DICENTIS are provided within our software under Docs.   Conference Protocol documentation & API   Also we providing for the INT-TXO an Conference Protocol documentation if you need to create an API.  ( for application development) which can be found as well on the https://licensing.boschsecurity.com/software/html/pages/home/   Additional important information   Receivers as well the Radiators have an cover angle and the installation must be planned carefully to avoid interference. Due to the infrared light technologies signal shadows can occur behind objects and direct sight to the Radiators is recommended.       More regarding beam behavior and delay in the manual.   Carefully room planning is needed.       Carrier management   Don't change during a conference the Carrier management since a rest will happen. Each Carrier can host four audio channels.   General settings     System info   Here you have the option to change your host name and access page. If you have more than 1 Transmitter name it for example after the room wher it is used. int-maincourd. = https:// int-maincourd.local/   Settings within the Meeting application   To hear the different translations you need to add them in the Language selection within the Meeting application. In the standard usage the translation channels were created form translators with DCNM-IDESKs so that Interpreter desks needs to configured as well. In the standard the INT-TXO provides 4  in and out put channels. Additional language channels must be bought. For example in this case as picture below. 0=floor 1=German 2=English 3=French   Now you can hear the German translation channel. The toggle button let you choose the correct translator channel.   For example this is how an Interpreter desk could be configured.   Password reset   In case you forgot your password for the web interface press the reset button for 10 seconds to delete all settings.   The green flashing data light will go off from your network cable.   And the LEDs will change if the reset is done correctly.   Now you can start all over again and configure your transmitter from the beginning but you need to be on side since an flip of the Master Slave switch is necessary to proceed.   Licensing   The TXO come with an standard 4 send and received license. If you need more language channels you need to buy a license. Up to 32 Channels are available additional of 28 INT-L1AL can be bought. (F.01U.406.935)   If you by an license you will get an Entitlement Certificate from Bosch.   How to activate licenses   Enter all your contact data , Add the Activation ID and create an license request file.   This is the request file.   Go to the System Activation site and log in with your technician account. https://licensing.boschsecurity.com/StartPage.aspx   Enter your password.   Choose Manage license   Select the INT-TXO created request file.   Press on Process An file will be created if successful transferred. Please contact the technical support if an error occurred here.   Brows in the TXO Licensing page for the ResponseRequest file which were created via the System Activation Site     Process the response message.   If everything was working fine a new column is created in the web page under Licensing.   It is also mentioned under System info. If you want to use now your new added translator channels you must add them as well in the Meeting application.   It is now possible to go up to 31 translator channels in the LBB4550/32 As example the Interpreter settings could be like this.   To be able to use all 32 channels you also need an receiver witch is capable of that. (LBB4540/32)   An Factory default reset will not delete this license.   Return of license   If you ever need to return the license copy the mac address.   Log into the System Activation Site with an technician account.   Search in the Overview under Fulfillment ID with the copied MAC address.   Select Location   And than Return Licenses   Press under Licensing the Brows button and open the new created ReturnRequest file   Press on Process response massage.   The Integrus will create an ReturnResponse file.   Process the  ReturnResponse file in the System Activation Site to release this license.   If everything worked fine you will get an green success message.   If you search now with your Activation ID on the System Activation Site you will see that your license is free to use.   Troubleshoot   1) If you have problems to activate or give back your license please contact the Technical Support for help. This is the list for EMEA without ASIA and AMERICA.     2) Please don't use this special cataract signs in the in the activation columns under Licensing! We once had a case were this special cataract Ō (Denmark) caused a problem with the activation file and later an customer from Czech Republic had a problem with an ě. Also an Spain customer had problems with ñ Ñ , á Á, é É, í Í and ú Ú.   3) Also there was an overlay discovered if you use >=6 IDesks. It will unfortunately send the 5th translation channel to 1st instead. Improvements are expected to be solved in DICENTIS version 5.10. ... View more

This article contains the list of Security Advisories (SA) to inform you about identified security vulnerabilities in our product or service and proposed solutions. 🔔 Subscribe to this article and Stay up to date with the latest published Security Advisories.   2023   Advisory number Title Affected Products Summary BOSCH-SA-893251-BT Publication Date:  2023-08-30       Remote Code Execution in RTS VLink Virtual Matrix           • RTS VLink Virtual Matrix Software           A security vulnerability has been uncovered in the admin interface of the RTS VLink Virtual Matrix Software. The vulnerability will allow a Remote Code Execution (RCE) attack. Versions v5 (< 5.7.6) and v6 (< 6.5.0) of the RTS VLink Virtual Matrix Software are affected by this vulnerability. Older versions are not affected. The vulnerability has been uncovered and disclosed responsibly by an external team of researchers. BOSCH-SA-247054-BT       Multiple Vulnerabilities PRA-ES8P2S Ethernet-Switch       • Bosch PRA-ES8P2S < 1.01.10       Multiple vulnerabilities were found in the PRA-ES8P2S Ethernet-Switch. Customers are advised to upgrade to version 1.01.10 since it solves all vulnerabilities listed. Customers are advised to isolate the switch from the Internet if upgrading is not possible. The PRA-ES8P2S switch contains technology from the Advantech EKI-7710G series switches. BOSCH-SA-988400-BT                       Update in Cybersecurity Guidebook of BIS on Permission Settings for Network Share                     • Bosch BIS                         In a recent survey of BIS installations worldwide Bosch identified that for some installations the security settings may not meet our recommended security standards. For this reason, we have updated our "Cybersecurity Guidebook". Section 4.5 of the Cybersecurity Guidebook describes how to configure access permissions for a shared folder of the BIS installation. In an older version of the Cybersecurity Guidebook, one of the recommended access permissions is wrongly stated as "Network" group instead of "Network Service" group. This information is updated in the new version of the documentation, because executing the earlier instructions may unintentionally grant access permission to potentially unauthorized users. This is not a software bug, just an update of the documentation targeted at installers. This document is included in BIS installation folder since version BIS 5.0. Previous BIS version do not contain the document, but validating the security setting is generally advised. BOSCH-SA-839739-BT       Information Disclosure Vulnerability in Bosch IP cameras       • Bosch Camera Firmware         An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information about the device itself (like capabilities) and network settings of the device, disclosing possibly internal network settings if the device is connected to the internet. This vulnerability was discovered by Souvik Kandar and Arko Dhar from Redinent Innovations, India BOSCH-SA-435698-BT     Possible damage of secure element in Bosch IP cameras     • Bosch Camera Firmware     Due to an error in the software interface to the secure element chip on the cameras, the chip can be permanently damaged leading to an unusable camera when enabling the Stream security option (signing of the video stream) on Bosch CPP13 and CPP14 cameras. The default setting for this option is "off". BOSCH-SA-110112-BT                     .NET Remote Code Execution Vulnerability in BVMS, BIS and AMS                     • Bosch AMS • Bosch BIS • Bosch BVMS • Bosch BVMS Viewer • Bosch DIVAR IP 7000 R2 • Bosch DIVAR IP all-in-one 5000 • Bosch DIVAR • IP all-in-one 7000 • Bosch DIVAR IP all-in-one 7000 R3 • Bosch DIVAR IP all-in-one 4000 • Bosch DIVAR IP all-in-one 6000 The Bosch Video Management System (BVMS), the Bosch Access Management System (AMS), and the Bosch Building Integration System (BIS) are using a vulnerable version of the Microsoft .NET package System.Text.Encodings.Web. The System.Text.Encodings.Web is a NuGet package from Microsoft, and Microsoft has published an advisory to provide information about a vulnerability in System.Text.Encodings.Web. A remote code execution vulnerability exists in System.Text.Encodings.Web due to how text encoding is performed.           BOSCH-SA-391095     Vulnerability in Wiegand card data interpretation     • Bosch AMS • Bosch BIS       Bosch Access Control products AMC2-4WCF and AMC2-2WCF have a firmware bug which may lead to misinterpretation of access card data that is sent from a Wiegand reader. This may in turn lead to granting physical access to an unauthorized person. This vulnerability affects only products with Wiegand interface, i.e., not devices with OSDP / RS485 interface. BOSCH-SA-025794-BT                       Unrestricted SSH port forwarding in BVMS                         • Bosch BVMS • Bosch BVMS Viewer • Bosch DIVAR IP 3000 • Bosch DIVAR IP 7000 R1 • Bosch DIVAR IP 7000 R2 • Bosch DIVAR IP all-in-one 5000 • Bosch DIVAR IP all-in-one 7000 • Bosch DIVAR IP all-in-one 7000 R3 • Bosch DIVAR IP all-in-one 4000 • Bosch DIVAR IP all-in-one 6000 The Bosch Video Management System is using SSH server that does not restrict a port forwarding requested by an authenticated SSH client. An authenticated SSH client can request a connection which is forwarded by the BVMS SSH server to a resource within the trusted internal network, which is normally protected from the WAN interface. The resource can be beyond the scope of the Bosch Video Management System.                 BOSCH-SA-341298-BT             Insecure authentication in B420 legacy communication module             • Bosch B420                 An authentication vulnerability was found in the B420 Ethernet communication module from Bosch Security Systems. This is a legacy product which is currently obsolete and was announced to reach End on Life (EoL) on 2013.  The B420 was last sold in July 2013 and was replaced by the B426. An EoL notice was provided to customers. The B420 does not allow for direct access to the panel as this module does not allow direct connection to the SDI/Option Bus that communicates directly with the panel. __ However, customers that are still using this device are advised to replace it for the B426 to ensure it is connected in a secure network. *CVSS - Common Vulnerability Scoring System ... View more