Firmware NBN-65023-B

New Features:
N/A

Changes:
• Fixed several issues in the recording engine related to retention time handling, recording mode fallback, and DST timezone offset block separation.
• Improved text layout for unsupported Hebrew characters, which are now displayed as spaces instead of rectangles for a cleaner presentation.

SHA256: A91DC01D9BDBF918440E2DE9D37885EB198D7ECB299B1622E4BEC415AD52AA97

New Features:
• The maximum length for Common Name (CN) and Subject Alternative Name (SAN) in certificate signing requests (CSR) has been increased from 63 to 64 characters. Additionally, when deriving the EAP-TLS Identity from the certificate, the allowed length has been extended remains limited to 31 characters.
• Developed a "Login Notification" feature that triggers a visual alert on the web UI for new access events, notifying users of login attempts in real time. By default, this feature is off but can be enabled in the appearance menu of the web UI.
• We’ve implemented a syslog enhancement at the Info level to improve tracking for both successful and attempted logins. The syslog now records the IP address of the accessing server or client, logs the system identification name with the user name and access level, captures the date and time of login (start) and logout (end), and tracks the user identifier. For failed login attempts, it logs the IP address, the identification name provided to the system, and the date and time of the attempt.

Changes:
• Added a new ONVIF command for the Framerate parameter in the Media2 service. This enhances control over video streaming configurations via ONVIF.
• Optimized performance to enhance reliability in low-bandwidth and unstable network conditions. This improvement utilizes safeguard buffers to prevent artifacts such as green lines and ensure stable operation for VMSs and other clients.
• Fixed an issue where cameras failed 802.1X authentication when using the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 ciphers. Authentication now works correctly with these cipher suites.
• Fixed an issue where RTSP connections could not be established between cameras and certain web applications. This was limited to specific applications using authentication methods.

SHA256: C64BEB0AFCBC026F12CD895BEE09DF191EC1905BA35C4667D901E009CE5F04BA

New Features:
• A banner has been introduced which allows to provide a system use notification to a user before authenticating.
• A switch has been added to directly activate or deactivate VCA without requiring the configuration plug-in.

Changes:
• An issue is fixed where the audio recording format was disabled and could not be changed after recording was stopped.
• An issue is fixed where the web interface was lacking responsiveness when HTTP was deactivated.
• An issue, apparent in FW 7.81 and higher, is fixed where video via RTSP over TCP sporadically appears black after recovering from a network interruption.
• An issue is fixed where a camera could be driven into constant overload due to non-closed connections, requiring a restart to recover.
• An issue is fixed where necessary network settings were set to default on application variant switching. This includes the hostname setting as well as the Remote Portal credentials.
• An issue is fixed where CONF_ALARM_OVERVIEW did not return proper state flags for VCA external simple states.
• Improved overall security by updating 3rd party components due to regular security maintenance.
• Some legacy RCP+ commands received a higher authentication level to further reduce the attack surface and improve security by default.

SHA256: A24D1899BA7A501AFB753FA3DBA1B488D6094F00142E0CAF6FD507F5BF7DA500

New Features:
• The video.mp4 URL now accepts parameters to stream using RTSP, and also to access stream 2.
• The RCP command CONF_ALARM_OVERVIEW now includes recording errors and SD card mounting states.

Changes:
• An issue with manual iris or focus control via ONVIF is fixed.
• An issue with certain VCA events erroneously reporting ‘signal loss’ via ONVIF is fixed.
• IVA detection results improved by pre-determined lens distortion models for DINION IP thermal 8000.
• An issue, introduced with firmware 7.85, where putting the camera in corridor mode caused continuous reboots, is fixed.
• Multiple vulnerabilities in 3rd party libraries that were identified during UL 2900-3-2 certification are fixed.
• An issue is fixed where 802.1x authentication failed when EAP-PEAP is requested prior to EAP-TLS.
• An issue is fixed where necessary network settings were set to default on application variant switching, now including hostname and unit name.

SHA256: 07FDB3E54E8667C92B116C09C8CD0A93BAEC1529631C04E9926203A2352EBC73

New Features:
• Cipher suites have been extended to provide higher security by adding the following ciphers:
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• DNS resolution has been extended to also cover URLs in FTP accounts.
• On cameras with value level 7000 and higher, Camera Trainer is now enabled without requiring a license.

Changes:
• An issue is fixed where the video stream is interrupted when an encoder profile is changed, e. g. due to adaptation for event recording by a DIVAR hybrid or network.
• An issue, introduced with firmware 7.81, is fixed where the OSD font size is too small (half height) when resolution is set to 1080p or higher.
• An issue is fixed by a better description in the web user interface that a certificate signing request requires the country code instead of the country name.
• An issue is fixed in the ONVIF metadata translation where latitude and longitude values were swapped.

SHA256: C141C93A8497483597D0DB99B3ADA5833FF9E45248C91831A1187947599C0EA8

New Features:
• Bandwidth throttling has been added to allow the camera being installed on networks with limited throughput capacity. The available bandwidth can be configured as kbps values in the Ethernet section of the Network Access menu. The camera will then limit its data generation on the network to this maximum Ethernet transmission value to avoid bursts in the network traffic. The Ethernet input on the camera is not limited.
• The Network Access menu has been separated for IPv4 and IPv6 addresses. IPv4 and IPv6 can now separately be configured and activated.
• IP filter entries have been extended to allow up to 20 IP addresses or ranges.
• For certificate-based network authentication, and in case of an unsubstantiated time base, the camera may assume its time from the overlapping validity periods in the EAP-TLS certificates, if this feature is enabled via the camera’s settings. With valid certificates, this will allow the camera to connect to the network even in case of an invalid system time due to e. g. a longer power loss.

Changes:
• An issue is fixed where insufficient memory allocation caused sporadic unresponsiveness of a camera’s web user interface.
• An issue is fixed where a wrong color was applied to alarm-triggered bounding boxes when using Camera Trainer.

SHA256: E0095E43AD32AA3C3B7F511855E52A24C6E2775307A0D3635170D5716D72A0B9