Sage Alerting Systems has released a mandatory security update for its U.S. Digital ENDEC model 3644 emergency-alert encoders and decoders, requiring station engineers to install it manually rather than wait for an automatic update.
The free Rev96-2 firmware, released November 5, removes at-risk eMudhra certificates used to validate Transport Layer Security connections to alert-audio servers, according to Sage’s notice. Separately, Microsoft has documented how recoverable certificate-authority keys could enable impersonation of trusted services. That risk does not establish that a station’s equipment has been compromised.
The update applies to units already running Rev96 or Rev96-1. Operators on older firmware should contact Sage support before proceeding. Sage’s download page and release notes provide installation and version-check instructions. The notes warn against loading older firmware after this update because mismatched components can disable the unit.
Federal Communications Commission rules require Emergency Alert System participants to install manufacturers’ security patches promptly. Pre-installation testing is permitted if it starts promptly and finishes within industry-best-practice timeframes; the rule does not specify a fixed number of days.
The reviewed sources do not establish exploitation of the affected Sage equipment or how many units remain unpatched.