Super Live Plus App
Support & Repair in
Manhattan

Method, building by building

Tenement cellars. Damp and heat shorten recorder life, so we read the drive’s health before anything else and move the box off the floor if it sits there. Coax cables run up light wells and along fire escapes; a hybrid DVR may be watching both old analog cameras and newer network ones, which changes what the app can show on each channel.

Upper Manhattan apartment houses. The router is usually the landlord’s, in the same closet. We reserve the recorder’s address on that router so a provider swap doesn’t move it, and we give the super an Ordinary-level user that can view and play back but not change settings or delete footage.

Mixed-use buildings. We separate the shop’s cameras from the residential ones by user permissions on the recorder, or, where the landlord and the shop really need independence, recommend a second recorder. We write down who owns which channels before changing anyone’s access.

Absentee-owner buildings. The owner keeps the administrator password; the super gets a viewing user; the managing office gets its own user. If the owner wants us to hold nothing afterward, we hand over the sheet and change our working password in front of them.

Shared apartments and lofts. One user per person, and no saved administrator login on any phone that isn’t the account holder’s. In loft offices we test the serial-number path through the building’s firewall before we leave, and if outbound traffic is blocked we bring the building’s IT contact into the decision rather than open an inbound port.

Where the recorder should live. In every building type the same rule applies: the recorder belongs somewhere locked, dry and ventilated, close to the router, and away from the people whose access it controls. A box on a shelf behind the deli counter or in an unlocked cellar can be unplugged, reset or walked off with by anyone, and with it goes the footage. Where moving it isn’t practical, a locked cabinet with a small fan does most of the job.

Logins, Roommates and People Who Left

A roommate moved out of our East Village apartment — how do we stop the cameras showing on their phone?

Change the password of whichever recorder user their phone logs in with, then give the people who remain their own users. Super Live Plus stores the login on each phone; there is no central account to close. If the roommate was using the shared admin login, changing it cuts them off and also cuts off everyone else until their phones are updated, so we do the remaining phones in the same sitting. This is the exact situation a poster on r/homesecurity described after a roommate left on bad terms.

If the system is a set of Wi-Fi cameras rather than a recorder, check each camera’s own user list too. And if the roommate ever had the router password, change that as well; otherwise they can still reach the recorder’s local interface whenever they visit.

The landlord, the handyman and two shopkeepers all use the same admin login — what does splitting that up involve?

About an hour at the recorder with the landlord present. We create a user for each person in the permission group that matches what they should do — the recorder’s Administrator, Advanced and Ordinary groups, or custom groups up to the eight TVT’s manual allows — limit each user to the channels they need, and then change the administrator password last, with only the landlord holding it.

The step people skip is writing it down. We leave a one-page list of users, groups and channels, so the next time a shop changes hands the landlord deletes one user instead of calling us.

Can a tenant be shown one hallway camera without seeing the rest of the building?

Yes, on recorders that allow per-channel permissions for a user, which most TVT-family units we see do. The tenant gets a user that can only view the hallway channel live, with playback and export off. The landlord decides whether that is a good idea; we make sure the recorder enforces the decision rather than trusting the tenant not to tap around.

Before agreeing, a landlord should think about what that camera sees. A hallway camera that shows a neighbor’s door is footage of the neighbor’s comings and goings; many owners decide to share recordings on request instead of live access.

The building changed managing agents — does the old agent’s phone keep working until someone acts?

Yes. Nothing expires. The old agent’s saved entry will go on working until the user it logs in with is deleted or its password changes. On the day management changes, the new agent should get a new user and the old agent’s user should be deleted, not just “not used”.

Open Ports and the Recorder’s Security Record

Our installer forwarded ports on the router years ago — are they still open, and do we still need them?

If nobody removed them, they are still open, and on most current recorders you don’t need them: turning on the recorder’s NAT option and adding phones by serial number or QR code gives remote viewing without any inbound port. We log in to the router, list every forward and UPnP mapping, test the serial-number path on a phone off the building’s Wi-Fi, and then delete the forwards.

Watch for the less obvious ones: a forward to port 554 for RTSP that a neighbor’s viewer or an old monitoring service used, or forwards to individual cameras rather than the recorder. Each one is a separate door.

How do we tell whether our white-label recorder carries one of the TVT flaws published since 2018?

Start with the firmware date on the recorder’s information page. For CVE-2018-25126, the record says firmware from mid-February 2018 onward addresses the hard-coded-credential flaw in NVMS-9000 builds. For later advisories, the affected model numbers are in the records — CVE-2024-7339, for example, names TD-2104TS-CL, TD-2108TS-HP, a Provision-ISR SH-4050A5-5L(MM) and an AVISION AV108T. We match the board and firmware to those lists rather than to the dealer’s name on the box.

If no fixed firmware exists for your exact model, the practical defense is the same one every advisory implies: keep the recorder unreachable from the internet, change default credentials, and plan its replacement.

Is switching UPnP on a reasonable shortcut for getting the app working?

No. TVT’s own NVR manual says UPnP is convenient but increases data-leakage risk because it forwards ports automatically, and recommends turning it off when not in use. A router with UPnP on will let the recorder, and anything else on the network, open holes nobody reviews. We use the NAT path instead and switch UPnP off unless a game console or another device genuinely depends on it.

What’s Really Behind the App

The recorder carries a sticker from a dealer we’ve never heard of — how do you work out who made it?

From the recorder, not the sticker. The local menu’s information page, the layout of the web interface, the default server port and the firmware version string usually place it in a family within minutes; on TVT-family units, port 6036 and the NVMS naming are strong hints. The Home Assistant forum shows how it goes in practice: a resident with an Avision DVR only got the camera streams working in another viewer after identifying the manufacturer behind the brand.

Knowing the family tells us which manuals, firmware and reset procedures apply, which advisories to check, and whether a replacement recorder will accept your existing cameras.

For a Manhattan shop, is it better to add the recorder to phones by serial number or by its address?

By serial number, in almost every case. An address starting with 192.168 or 10. only works inside the building, so for viewing from outside the recorder should be re-added by serial number or QR code. If it is a public address or a domain name, it depends on a port forward, which is the thing we would rather remove. A user on r/tinycam described viewing cameras through SuperLive Plus with a 12-character identifier, a username and a password — that serial-number path is what we set up.

Footage, Detectives and Connect New York

A detective asked for last night’s video from our storefront — can we send it from the phone app?

You can send a phone recording as a quick look, but the copy that matters should come from the recorder: exported at full quality, from the right channel and time window, with the recorder’s clock checked against real time. We write down who exported it, when, and what was handed over. If the clock is wrong, say so in writing rather than “fixing” it before the export.

Ask the detective what format they want before exporting. If the recorder’s native format needs its own player, include the player or a converted copy as well as the original.

Can a recorder our staff view in Super Live Plus be linked into Connect New York, and what do we keep control of?

The program says integration needs a small fususCORE device plugged into your router, costs nothing, and lets you choose which cameras are shared and when; its device-compatibility page is the place to check your recorder model. Super Live Plus keeps working as before — the program connects to the recorder or cameras, not to the app. We check which channels face public areas, give the program its own recorder user, and keep it separate from staff logins.

If we only register our cameras with Connect New York, can police log in to them?

No, according to the program’s own FAQ: registration only tells the NYPD where cameras may be located, and gives no remote access to the video. Real-time sharing requires the integration box and the owner’s written permission. Registration changes nothing on the recorder.

Small Landlords and Rent-Stabilized Buildings

If the landlord replaces the camera system in a rent-stabilized building, can that turn into a rent increase?

It can be claimed as one. The schedule of major capital improvements in the state rent regulations includes a new security monitoring system, and DHCR publishes reasonable-cost figures for cameras, monitors and receivers. Whether a particular job qualifies is DHCR’s decision, not ours. What we can do is give the owner an itemized invoice that separates repair of an existing system from new equipment, which is what an application or a tenant challenge will turn on.

Our four-family walk-up has no super on site — who should hold the recorder’s administrator password?

The owner, and only the owner. The person who visits weekly gets a viewing user; tenants who need a camera get their own limited users; and the administrator password lives in the owner’s password manager, not on a sticky note in the cellar. If the owner can’t be reached in an emergency, a second sealed copy with the managing office is reasonable.

Stores and Restaurants

Can a deli owner watch the register camera while the counter staff can’t change any settings?

Yes. Staff get Ordinary-level users that can view and play back the channels they need, with configuration, deletion and export switched off; the owner keeps an administrator user. On the shop’s monitor, the recorder should sit logged in as a viewing user, not as admin, so anyone at the counter can’t walk into the menus.

The small-business security tax credit — can we still claim it for a camera repair?

Probably not for work done in 2026. The $3,000-per-location credit created in New York’s 2024–25 budget expired at the end of 2025 and had not been renewed as of early 2026, according to Avigilon’s guide; its eligibility rules covered retailers with 50 or fewer employees and minimum spending thresholds. We give you an itemized invoice either way; your accountant decides what it qualifies for.

Several Phones, Several Properties

A counter worker used a personal phone to watch the shop — what should happen on their last day?

Delete their recorder user before they leave the building, not after. If they were on their own user, that one step ends their access and nobody else notices. If they were on a shared login, it is the same job as any shared-login clean-up: new users for everyone who stays, then the old password changed. Ask them to delete the saved entry from their phone too, but don’t rely on it.

For shops with regular turnover, we set up a short routine: each new hire gets a user named for them on day one, with the channels and rights the job needs, and the manager deletes it on their last shift. It takes a minute on the recorder and avoids the evening phone call when someone realises a former employee is still watching.

We own a walk-up in Harlem and a store on Orchard Street — how do we keep the store manager out of the building’s cameras?

Give the manager a user on the store’s recorder only, and nothing on the building’s. Super Live Plus keeps a server list in which each recorder is a separate entry with its own address or serial number and its own user and password. The owner’s phone holds both entries; the store manager’s phone only has the store; the super’s phone only has the building. Keeping them separate on the recorder side matters more than tidiness in the app, because each recorder enforces its own users.

Use different administrator passwords on the two recorders. If one is ever exposed, the other is not.

Family members abroad want to see the store — is that safe?

It can be, if each gets a viewing-only user rather than the owner’s login, and if the recorder is reached by serial number rather than through an open port. Their phones may also need the app’s region setting changed, which the FAQ below covers. We set each relative’s phone up while they are on a video call with us, test it over their own connection, and note on the hand-over sheet whose user is whose so a cousin’s access can be removed later without touching anyone else’s.

How many people can sensibly share one recorder?

More than most small properties need, but the limit that matters is management, not the box. TVT’s manual allows up to eight permission groups; what keeps a system safe is that every person has a named user someone can delete. For a walk-up we usually end with four to eight users: owner, super, managing office, and a few tenants or shop staff with single channels.

Apartments and Wi-Fi Cameras

Our apartment uses Wi-Fi cameras added straight to the app, with no recorder — does any of this apply?

Most of it, camera by camera. Each network camera has its own users, its own firmware and its own way of being reached from outside, so a household with four cameras has four lists to clean up. We check each camera’s users, switch off any port forward or UPnP mapping the router made for it, and re-add it to each phone by serial number or QR code where the camera supports that.

If the cameras record to memory cards inside them, the clips live in the camera, not in the app; if a camera is stolen or knocked off the wall, its footage goes with it. For entrances that matter, a small recorder in a closet is often the better long-term setup.

A Wi-Fi camera that worked on the kitchen counter keeps dropping once it’s mounted by the door of our pre-war apartment — why?

Usually the walls and the distance. In a long railroad or pre-war layout a camera by the front door can be several rooms and thick partitions away from the router — a thread on r/NYCapartments from a tenant in a pre-war railroad two-bedroom is one long list of people fighting exactly that. The app reports it as offline or loads slowly; the camera itself is fine. A mesh node or access point closer to the door, or a network cable to that spot, fixes it more reliably than moving the router around.

Should the cameras share the Wi-Fi network our laptops use?

Better not, if the router allows a separate network. Putting cameras and the recorder on a guest or isolated network means that if one of them is ever compromised, it can’t see the computers and phones the household uses for banking and work. Most provider routers in Manhattan apartments can do this; we set it up and re-add the cameras to the app afterwards.

Booking the Visit

What should the owner have on hand when the technician arrives?

The router’s admin login or the person who has it, the recorder’s administrator password if anyone knows it, the list of people who should keep access, and access to wherever the recorder physically sits. If the recorder is in a tenant’s store, the tenant needs to know we are coming.

Can the work be done while the store stays open?

Usually. User changes and router clean-up don’t interrupt recording. A firmware update or a recorder reboot takes the cameras off for a few minutes, so we schedule that part for a quiet hour and tell staff before it happens.

“Super Live Plus is Dahua’s app” or “it stands for Digital Mobile Surveillance System”

Both are mix-ups. DMSS is the name of Dahua’s viewer, a different product. SuperLive Plus on Google Play carries the package name com.tvt.superliveplus and names TVT (HK) Limited in its developer details, and its sister app SuperCam Plus uses com.tvt.supercamplus.

The confusion matters because people follow the wrong instructions. A Dahua reset procedure, port list or firmware file does nothing useful on a TVT-family recorder, and some of it can make things worse.

So our first step is always to identify the recorder family from the box itself. The app name is a clue; the sticker on the front is a dealer’s name; the firmware and interface tell the truth. On a Manhattan visit that takes a few minutes with the recorder’s local menu open, and it decides every step after it.

“Factory-reset the DVR and set it up again”

A reset is sometimes the end of the road, but as a first step it destroys evidence: the user list that shows who had access, the network settings that show which ports were forwarded, and sometimes the recording schedule. TVT’s manual describes gentler options, including security questions and recovery by a user with account-management permission.

In a building with several people on the system, a reset also cuts everyone off at once, and someone then has to re-add every phone.

We read and photograph the configuration first, try the recorder’s own recovery options with the owner present, and reset only when nothing else works, after confirming the drive’s footage isn’t at risk. If a reset is unavoidable, we export anything the owner may need first and photograph every setting we will have to rebuild.

“Forward ports 80 and 6036 and the app will connect”

It will, and that is the problem. Every forwarded port is reachable by anyone who scans the internet, and the TVT family’s advisories — from the hard-coded credentials in CVE-2018-25126 to the command injection in CVE-2025-34036 on ports 81 and 82 — are about exactly those exposed services. SecurityWeek’s June 2025 report on Bitsight’s research found more than 40,000 cameras worldwide streaming openly over HTTP or RTSP.

Most of the recorders we see can reach the app without any forward once NAT is enabled and phones are added by serial number.

Where a forward truly has to stay, it goes to a recorder with current firmware, a strong password and no default users — and it gets written on the hand-over sheet so the next person knows it exists. A forward nobody remembers is worse than one that is documented, because nobody checks it when the next advisory is published.

“Delete the app and reinstall it”

It is on nearly every generic checklist, including one app-help forum’s eight-step list for SuperLive Plus “device offline”. Reinstalling fixes a corrupted app. It does nothing for a recorder that has lost its network, a password someone changed, or a forward the new router doesn’t have.

It also deletes the phone’s saved device list, so the user then has to remember an address, serial number and password they may never have known.

Before reinstalling anything, screenshot the device entry. That screenshot usually tells us more than the reinstall would: whether the phone uses a local address, a domain name and port, or a serial number, and therefore where the break is.

“Any DVR or NVR works with Super Live Plus”

The Play Store listing itself says “compatible models only”. The app speaks to recorders and cameras from the TVT family and the brands built on it; a recorder from another maker needs that maker’s app.

We meet this when a shop replaces a failed recorder with whatever was cheapest and expects the old app to find it. It won’t, and the staff’s saved entries become useless at the same time.

If you are replacing a recorder, decide first which app everyone will use, and make the purchase fit that decision. A shop that buys a recorder from another maker should expect every phone to need a new app and a new login on the same day.

“Turn on alarms in the app and you’ll be notified of everything”

The SuperLive Plus manual describes local alarm options in the app — a sound or a shake when video loss, a sensor or motion triggers — and the recorder decides what counts as an event. On a Canal Street or Orchard Street storefront, a camera pointed at the sidewalk will trigger on every passer-by.

Owners who switch everything on stop looking within a week, which is worse than no alerts at all.

We set motion zones on the recorder to the door, the register or the stockroom, schedule alerts for closed hours, and leave the street-facing channels recording without notifying. Fewer, better alerts are the ones people still open after a month.

“Change the app’s Domain to Global to fix offline”

That fix is real but narrow. CCTV Camera Pros documented it for a customer whose app showed offline in Canada: Settings, Local, Domain, set to Global. It addresses a phone in the wrong region, not a recorder that has dropped off its network.

For a phone in Manhattan with a recorder in Manhattan, the Domain setting is rarely the cause. Changing it at random can make a working phone fail.

Remember the setting when you travel abroad, and otherwise leave it alone; if the recorder is offline at home, the problem is at the recorder or the router. That is where we start, not in the phone’s settings.