Sage Alerting Systems has notified users of Sage Digital ENDECs of a mandatory security update. The product is used at many U.S. radio stations.
“This update falls under the FCC’s recent rules change requiring prompt installation of security updates,” President Harold Price wrote in an email.
“The issue involves several certificates issued by a Certificate Authority called eMudhra that have weak, easily guessable, private keys. These certificates are a ‘trust anchor’ for certificate chains used to verify access to websites. The weak keys can, in the right circumstances, be used to spoof domain names.”
Price said that IT organizations worldwide are blocking or removing the affected root certificates.
The Sage ENDEC does not automatically update its software; users must manually install Sage’s software update. Links to the release note and download page are at the bottom of this story.
“It is unfortunate that this issue was discovered close to the National Periodic Test and the PHP problem,” Price said Thursday evening.
“However, the three items are not related. The ENDEC does not use PHP, but we do have the eMudhra root certificates that were in common use. Sage can help users who are unfamiliar with the update procedure; email to [email protected] for assistance.”
Tech details
The alert is for Digital ENDEC model 3644 and applies only to users in the United States.
The free firmware update is version 96-2, also known as 96-02, for U.S. users running Rev96 or Rev96-1. (Sage noted that all active Sage ENDECS should already have been running at least the Rev96 version, issued in February 2024, to stay compliant with FCC Part 11 rules.)
Version 96-2 removes compromised eMudhra root certificates used to secure TLS connections for alert audio servers. The release also resolves SMTP email attachment compatibility issues with some mail servers and allows the use of “&” and “+” in web GUI passwords.
Rev 96-2 Release Notes: https://www.sagealertingsystems.com/rev96-2-release-notes.pdf
Rev 96-2 Download Page: https://www.sagealertingsystems.com/rev96-2download.html
