URGENT: PHP Vulnerability … UPDATED !

Updates …

UPDATE 20261105 – We are releasing API 154 and App 1.84. If you have a HamVoIP based node it will install Supermon2 along with other bug fixes and improvements.

UPDATE 20261104 – HamVoIP issued a new firmware version yesterday Nov 3rd to address the PHP vulnerability – “RPi2-3-4 Version 1.7-10 Allstar – November 03, 2026 – K4FXC” – you should be offered the update in your copy of the ClearNode Smartphone App – please update as soon as possible.

UPDATE 20261103 – We are releasing ASL3 Version String: “Asterisk 22.10.1+asl3-3.10.8-1.deb12” – this update includes the critical patch to the PHP programming language. Please be patient !!! – this update will take many minutes to complete, especially on older Pi Zero and Pi 3 based nodes. Start it up before you go to bed and check on it in the morning.

Background and required actions …

The most important thing to understand is that this is ONLY a risk if you are allowing users outside your local network to access Supermon or Allmon on your node. You would have allowed this by setting up a port forwarding rule in your WiFi/Router for the port of the Supermon or Allmon web servers, typically port 80. This is NOT something Node-Ventures or your ClearNode would do for you automatically – it would have been explicitly done by you or by another at your request.

Note: this is NOT the port forwarding rule many of you have installed to allow incoming connectiosn for AllStar or EchoLink. Those connections are not affected.

If you are aware that you have installed the web server port forwarding rule for Allmon or Supermon – DISABLE OR REMOVE IT IMMEDIATELY.

We are going to release an update in the coming days that will remove this vulnerability, irrespective of your having exposed the web server to outside users.

For ASL3 based nodes this will be a standard package update and you will be notified in your ClearNode Smartphone App when it is time to update.

For HamVoIP based nodes this will involve installing Supermon2 and disabling Supermon – this will be automated in an update script, along with a package update from HamVoIP, which I believe they are currently testing.

73 … Gerry.


ClearNode API 153 and App 1.83 released …

In this release:

  • WiFiByLight has been fixed in iOS 27 – interesting changes in Flashlight management in iOS
  • Improved ASL3 version detection to prevent repeated update invitations
  • Reorganized Archive/Backup/Restore to cover more of the configuration options
  • Improved internet connection detection and reporting
  • Improved configuration of Private Nodes in ASL3

73 … Gerry.


ALERT: iOS 27 has broken WiFiByLight … (UPDATED)

(UPDATE: We think we found the problem and we think we have the solution – it will be in the next iOS App release.)

We’re investigating, there seems to be a flood of suggestions and assumptions being presented by the venerable Google Gemini. There seems to be some new functionality in the driver that controls the camera and flashlight.

We will keep folks informed as we find out more.

In the meantime – we recently implemented “WiFi Rescue Mode” in the ASL3 image which enables your node as a WiFi Hotspot when it cannot reach the internet – that way you can reset your WiFi Credentials.

73 … Gerry.


ClearNode API 152 and App 1.82 released …

Changes in this release:

  • Fix for the TCP Direct Connection authentication process
  • Configuration option to allow IP Tunnel to be automatically connected upon startup
  • Indicate in Node Details when the IP Tunnel is running
  • Prevent EchoLink and the IP Tunnel from being enabled simultaneously
  • Include the output of ‘asl-node-auth-check’ with Query AllStar Registration
  • Implement a new node configuration ‘Archive’ process that captures all major configuration items
  • Better configuration transfer when transitioning existing nodes to ASL3

73 … Gerry.


ClearNode API 151 and App 1.81 released …

Major change in this release is the addition of the WiFi Rescue Mode that turns your node into a WiFi Access Point when it cannot reach the Internet. In this mode you can connect your Smartphone to the node over WiFi, and using the ClearNode Smartphone App push new WiFi credentials to the node so it can re-connect to the Internet. This “Rescue Mode” is in addition to our long standing WiFiByLight functionality.

Instructions at the bottom of the Getting Started page.

This functionality is only available in the ASL3 image – it is not supported for those nodes running HamVoIP. Also note that this is not the “ASL-Fallback-AP” functionality that is currently being tested in the ASL3 Beta channel.

We are also providing the “wait times” in AllStar Setup so users can adjust those values to their own satisfaction,

73 … Gerry.


ClearNode API 150 and App 1.80 released …

Here are the changes:

  • Support for our new IP tunneling service (for those suffering from CGNAT issues)
  • Improve UI for displaying Audio Analysis
  • Implement DVSwitch package repository changes
  • Extend ID wait time to support SA818 radio transmit ramp up delay
  • Implement support for Kernel GPIO changes in the Pi 5B

73 … Gerry.


ALERT !! – Messaging server migration … (COMPLETE)

(The migration is now complete and everyone should be back to normal.)

We are in the process of moving our Node to App messaging hub to a new server. This will inevitably cause some missing messages leading to the Smartphone App losing communication with your nodes. The interruption should be temporary, we hope lasting no more than an hour.

To speed up the migration for your account, feel free to reboot your nodes and restart your instance of the Smartphone App.

73 … Gerry.


RESOLVED !! – Notifications are failing …

We are currently tracking an issue with our Notification Service which is preventing both Apple and Android notifications being delivered to users.

Resolution: Some goofy coding on our part was being ignored – updating the server to modern libraries exposed the issue and forced us to fix it. All good now.

73 … Gerry.


Mobile Hotspot CGNAT issues ?

CGNAT has been identified by the AllStarLink.org group as a known issue for AllStar. We can confirm that we see the same – in fact the frequency of incidents has been steadily growing.

CGNAT is a technology used by Internet Service Providers to share a single public internet address amongst multiple installations. Imagine if you lived in an apartment building with a single street address – but no apartment numbers – how do you get your mail ?

We’re testing a new service to alleviate the issue and we’re looking for a handful of qualified individuals to test the new service. So if you’re a T-Mobile or Starlink user that has been suffering from the typical symptoms: unable to connect, connection drops – get in touch with support@node-ventures.com and let’s see if it makes sense for you to try the service on your installation.

Note: there are some limitations to this service – it doesn’t allow incoming AllStar connections, only outgoing. It does NOT solve the port forwarding issues typical with EchoLink running on mobile hotspots. The Digital Modes appear to work just fine.

73 … Gerry.


ClearNode API 149 and App 1.78 released …

  • Added more validations to certain items in AllStar Setup
  • Added warning that node should be set in Duplex Mode Zero when running Audio Analysis
  • More consistent indicator on device and in App when node is updating/upgrading software
  • New Chartreuse indicator color when COS and PTT are asserted simultaneously – to support full duplex mode

73 … Gerry.