6.1.2.42921 Video Management System
PUBLISHED 20 May 2026
Release Notes:
IMPORTANT:
- These release notes cover changes implemented since the latest major release (6.1.1.42471).
BREAKING CHANGES:
- Support for MacOS 12 will be discontinued in the next major release (6.2).
- The Paxton plugin will be removed from the distribution package. The latest release for Paxton Net2 Pro v5 / v6 (6.1.1.42624) will be available on the “Previous Releases” page on Cloud Portal.
- Security hardening:
Access-Control-Allow-Credentials is now false. Browser integrations using cookie-based authentication on cross-origin requests (including fetch with credentials: 'include', XHR.withCredentials = true and Axios requests with withCredentials: true) will stop working and must migrate to Authorization: Bearer <token>.
NEW DEVICES / OPERATING SYSTEMS SUPPORT:
- Raspberry Pi OS 13 (Trixie)
SECURITY UPDATES:
- Security hardening:
Access-Control-Allow-Credentials is now false. Browser integrations using cookie-based authentication on cross-origin requests (including fetch with credentials: 'include', XHR.withCredentials = true and Axios requests with withCredentials: true) will stop working and must migrate to Authorization: Bearer <token>.
- Server now sends HSTS headers during the HTTP → HTTPS redirections. As a result, the initial connection is no longer vulnerable to SSL stripping and MITM attacks.
GENERAL IMPROVEMENTS:
- Server Monitoring graph colors improved.
- VCA edge build size is optimized - debug symbols are removed.
- Localization has been improved.
Timeline date format id consistent with OS date format.
- It is now possible to download full health report at the “Advanced > Logs Management” page.
ENTERPRISE FUNCTIONALITY IMPROVEMENTS / FIXES:
- Fixed the issue with reporting Live Streaming service usage.
ANALYTICS IMPROVEMENTS / FIXES:
- Added Intrusion Detection events support on Milesight cameras.
- Metadata parsing (object attributes) is added for the Vivotek analytics plugin.
- After upgrading to 6.1, if trying to choose a Vehicle type in the Milesight plugin search box, it searched for bikes. Fixed.
- On Hikvision cameras, wrong previews of analytic objects (Vehicle or LPR) were shown on the right panel in the Desktop Client. Fixed.
- The Vivotek analytics plugin could initiate a large number of false-positive error notifications. Fixed.
- The analytic event/object from the Vivotek SD9384-EHL could stop appearing in the Desktop Client after some time. Fixed.
- Dahua analytics plugin did not load for autodiscovered devices (i.e. DH-SD22204UE-GN). Fixed.
- The built-in Milesight analytics could shows unexpected "Unknown" objects. Fixed.
- The analytics database could completely fill the storage after upgrading to v6.1. Fixed.
DEVICE SUPPORT AND FIXES:
- Hanwha Devices:
- On Hanwha Profile G cameras (i.e. XND-9083RV), imported archives could have missing periods after network disconnection. Fixed.
- Devices Specific Fixes:
- I/O monitoring was enabled on Axis devices after initialization even if it was not enabled in the Desktop Client. Fixed.
- The secondary stream was not available on Dahua DH-IPC-HDBW2441* camera models after upgrading to 6.1. Fixed.
- Dahua DH-IPC-HFW366* camera models now support 2-way audio.
- Fixed PTZ on Hikvision DS-2DP3236ZIXS-D/440.
- If Hikvision cameras were not connected to the Internet, the time stamps of thermal events could differ. Now, the system time is used.
- After upgrading to v6.1, some Hikvision cameras (i.e. DS-2CD2*) could become unauthorized. Fixed.
- After upgrading to 6.1, Server could unexpectedly change streams configuration on HikVision DS-2TD2617* camera models after Server reboot. Fixed.
- Incorrect camera firmware version was displayed for Hikvision DS-2CD2743G2* model line with firmwares 5.7.19+. Fixed.
- On Milesight devices, audio alarm can be enabled even if audio input was disabled in the camera settings. Fixed.
- Files exported from some Arecont Vision panoramic cameras, could not be played back. Fixed.
- Fixed PTZ on Hikmicro HM-TX3840-10*
- Newly Supported Devices:
- Encoders added to the analog list:
- Hikvision DS-7632* series, DS-9032HUHI-K8.
- Avycon AVR-NSV64E2N, AVR-NSV32P16
- Multisensor Cameras:
- Hikvision DS-2SE4C425MWG* and DS-2CD2346G3D* series
- Hikmicro HM-TD1228*, HM-TX3840-10* and HM-TD2628* series
- Axis Q6300
- IVSEC NC542ADX
- Dahua DH-IPC-HDBW2449F
- Pelco SMLE1-24V5* and SMLE1-32V5* series
- Panasonic wv-s8530
- Invid VIS-P4DUALDRIR28NH* series
- Digital Watchdog DWC-XMDS20Mi, DWC-XMDF32H, DWC-XDBJ10Mi, DWC-XTBG05DiT
Safire Smart SF-IPTB640A*, SF-IPTB384A*, SF-IPTB256A* series
- Advanced PTZ:
- Sparsh SS-IND212* series
- Pelco ESCE1-2X40* series
BUG FIXES:
-
General UI Fixes:
- The "Floor/table" mount option in the dewarping settings was not visible by default. Fixed.
- Some entries could appear in the Audit Log as actions with no user account specified. Fixed.
- In 6.1, we made a change that saved the playback speed when clicking play-pause. After complaints from users, we revert back this change: as soon as the video is paused, the playback speed will be reset. There will be the option to change this behavior.
- "Do HTTP(s) Request" rules with whitespaces in the URL did not work in 6.1+. Fixed.
- Fixed scrolling issues with events in the notification panel.
- In multi-Server environments, multiple "Unsuccessful login" entries appeared in Audit Trail when trying to open bookmarks from a device where the archive was spreaded across different Servers. Fixed.
- In big systems, recording and device statuses may be displayed incorrectly after upgrading to v6.1. Fixed.
- Fixed the Desktop Client crash that could occur when browsing the timeline with 4x4 or 5x5 layouts opened.
- On some Sites, users failed to authenticate via temporary links and were prompted to authenticate through Cloud instead. Fixed.
- Fixed the scaling issue when many Server monitoring items were opened on the layout.
- In multi-monitor environments, if multiple instances were opened on specific monitors, the configuration was not restored after restart. Fixed.
- The default user groups (Administrators and Power Users) were also selected as recipients in the Send Mail action even if only one email address was specified. Fixed.
- The Desktop Client did not restore state for the "Bookmarks" and "Events" tabs after restart. Fixed.
- In certain environments, the Desktop Client could show an empty timeline portion past the certain date. Fixed.
- The role description in Group Details was not fully visible without scrolling. Fixed.
- In the User Management > Resources dialog, group-level selection in search did not work consistently. Fixed.
- Bookmarks sometimes could start playing a few seconds earlier than their start time. Fixed.
- Fixed the Desktop Client crash when dragging a cloud layout onto a video wall.
- Multi Video export to .nov format could freeze if a decent amount of time (few hours) was exported. Fixed.
- The "Available by Permissions" setting in the Resources tab for a new group/user could be reset. Fixed.
- The Desktop Client lost connection to Cloud and required to authenticate again if connecting to a different Server version. Fixed.
- Fixed a visual rendering bug that caused the system tray icon context menu to display unreadable characters on Windows 10 Enterprise 2016 LTSB (build 1607), introduced in version 6.1.0.
-
Server Fixes:
- Media2 requests were sent to devices even if the "Use Media2 to fetch profiles" advanced option was set to "Never". Fixed.
- Devices were shown as unauthorized after password reset, even if the password was correct until it was changed back to the original one on both sides (device and VMS) or remove and re-add the device with the new password. Fixed.
- Motion & Events Panels could scroll down on its own after idling for a while. Fixed.
- In some cases, it was not possible to merge a Server with the Site with a custom certificate installed. Fixed.
- Emails initiated by a Server were missing URL to the recordings in the plain-text body. Fixed.
- Server crashed after a WebRTC camera was created, started streaming live, and then stopped live stream. Fixed.
- If a user’s OU was changed in the LDAP server, Server treated this user as a new one, and a new user entry was created after the LDAP sync (with the duplicated user name). Fixed.
- When adding RTSP streams, Server did not check all supported authentication algorithms. Fixed.
API / SDK FIXES:
- Fixed the streaming issues via vmsproxy (
https://${relay}.vmsproxy.com/rest/v3/devices/{$device_id}/media.mp4) using FFplay.
- When trying to perform an export using the
/rest/v3/devices/ method with the continuousTimestamps parameter specified, utcTimestamps were ignored. Fixed.
- REST API:
rest/v4/events/log changed its eventsOnly parameter behavior.
- API responses containing GUIDs, are changed in V4 - there will be no
{} symbols:
- In v3 or earlier -
“{%guid_string%}”
- In v4 -
“%guid_string%”
- Fixed a wrong response from
rest/v4/servers/this/storages with ETag.
- Timezone ID and offset information is added to the exported media file metadata when export is performed via the
/rest/v3/devices/ method.
- The readonly field
prolonged is added to rest/v4-/events/rules to evaluate triggers by rules only.
- WebRTC: metadata packets are now being dropped when the channel capacity is insufficient.
- WebRTC: Websocket connection failed after a live stream was restarted. Fixed.
- Plugin Analytics SDK:
utilitiProvider()->cloudToken() did not return the token. Fixed.
- Added advanced PTZ functions that were missing in the in v4 Rest API comparison to legacy /api/ptz:
ContinuousFocusPtzCommand , AbsoluteLogicalMovePtzCommand, relative pan/tilt/zoom/focus/rotation capability bits, ViewportPtzCapability, FlipPtzCapability, HomePtzCapability, AuxiliaryPtzCapability.
- Server responded with "Not found" to unauthorized JSONRPC requests instead of "Unathorized". Fixed.
GET /rest/v4/devices required {} when using the _filter option (i.e. /rest/v4/devices?serverId={ced42fd2-d6ee-c192-8ddc-a0f820b71e24}). Now, they are optional.
In-Client Upgrade:
| Build Number: | | 42921 |
| Password: | | 9ce7bm |
Download Links:
