Updates …
UPDATE 20261105 – We are releasing API 154 and App 1.84. If you have a HamVoIP based node it will install Supermon2 along with other bug fixes and improvements.
UPDATE 20261104 – HamVoIP issued a new firmware version yesterday Nov 3rd to address the PHP vulnerability – “RPi2-3-4 Version 1.7-10 Allstar – November 03, 2026 – K4FXC” – you should be offered the update in your copy of the ClearNode Smartphone App – please update as soon as possible.
UPDATE 20261103 – We are releasing ASL3 Version String: “Asterisk 22.10.1+asl3-3.10.8-1.deb12” – this update includes the critical patch to the PHP programming language. Please be patient !!! – this update will take many minutes to complete, especially on older Pi Zero and Pi 3 based nodes. Start it up before you go to bed and check on it in the morning.
Background and required actions …
The most important thing to understand is that this is ONLY a risk if you are allowing users outside your local network to access Supermon or Allmon on your node. You would have allowed this by setting up a port forwarding rule in your WiFi/Router for the port of the Supermon or Allmon web servers, typically port 80. This is NOT something Node-Ventures or your ClearNode would do for you automatically – it would have been explicitly done by you or by another at your request.
Note: this is NOT the port forwarding rule many of you have installed to allow incoming connectiosn for AllStar or EchoLink. Those connections are not affected.
If you are aware that you have installed the web server port forwarding rule for Allmon or Supermon – DISABLE OR REMOVE IT IMMEDIATELY.
We are going to release an update in the coming days that will remove this vulnerability, irrespective of your having exposed the web server to outside users.
For ASL3 based nodes this will be a standard package update and you will be notified in your ClearNode Smartphone App when it is time to update.
For HamVoIP based nodes this will involve installing Supermon2 and disabling Supermon – this will be automated in an update script, along with a package update from HamVoIP, which I believe they are currently testing.
73 … Gerry.
