securityProbe 5E-X20 PHP vulnerability question

Dear Valued Customer,

Yes, our engineering team are fully aware of the PHP issues and have confirmed that the AKCP securityProbe (5E, 5ES, 5ESV, 5E-X20, X60) base unit family of units are affected by the PHP2shell vulnerability.

Our team are currently integrating the fix for this and it will be included in an updated firmware version. This new firmware will be posted on our website support portal at the latest in the next few days.

After logging into our support portal, this will be the link to the firmware download page: https://forum.akcp.com/securityprobe5es-firmware/

This forum Q&A post will also be updated with the details when the new firmware is available for download.

We strongly do not recommend making the securityProbe devices publicly accessible from the internet (either if they have password checking enabled) due to them still being vulnerable. However, having the devices on-site in a closed network they should be fine.

Also please take note regarding our sensorProbe+ base units:

The AKCP SP+ (SP2+, SPX+, SP-WTS) devices do not use PHP. They run a custom non-PHP embedded web stack on our F4/F7/H7 hardware, so they are completely unaffected by these new CVEs.

If you have any additional questions on this post, please contact our support team directly (support@akcp.c0m) and we will get back to you within 24 hours.

Best regards,

AKCP Support Team

Dear Valued Customers,

Those of you who are using our AKCP securityProbe base units should promptly update your units to the newly released version 406L firmware which is now live and has been uploaded to our website support portal.  This version includes the improvements regarding the PHP2shell vulnerability and other security fixes.

The updates and improvements can be located in the change log that is included in the firmware download package, along with the firmware upgrade step-by-step instructions.

Important Note:
Customers should temporarily disable their notification rules for all Dual Temperature/Humidity sensors before upgrading from 406a to this firmware to prevent sending an incorrect alarm notification. After the upgrade, don’t forget to re-enable the notification rules again.

If you have any issues or further questions, please contact our support team via email at support@akcp.com. We also suggest you continually check this forum for other technical questions, answers and helpful information on all of our products as we are continuously updating it.

Thank you,

Best regards,

AKCP Support Team