Sage Issues Mandatory Firmware Update for Digital ENDEC

By James Calloway

Sage Alerting Systems has issued free firmware version 96-2, also known as 96-02, as a mandatory security update for U.S. users of the Digital ENDEC model 3644 running Rev96 or Rev96-1. The release removes compromised eMudhra root certificates used to secure TLS connections for alert audio servers.

Sage Digital ENDECs are used at many U.S. radio stations. The company said IT organizations worldwide are blocking or removing the affected root certificates, adding a global certificate-trust problem to a device update with a defined U.S. scope.

What does this change for U.S. radio users?

Affected stations must download and install the firmware manually because the ENDEC does not update its software automatically. The eligibility and delivery details are specific:

• Product: Digital ENDEC model 3644.
• Market: United States only.
• Eligible revisions: Rev96 or Rev96-1.
• Firmware: free version 96-2, also designated 96-02.
• Installation: manual download and installation.

Sage said all active Sage ENDECs should already have been running at least Rev96, a version issued in February 2024 to keep the products compliant with FCC Part 11 rules. The alert therefore updates an existing compliance baseline: Rev96 had been available since February 2024, while version 96-2 adds the certificate removal and two software fixes.

Harold Price, Sage president, wrote in an email: “This update falls under the FCC’s recent rules change requiring prompt installation of security updates.” Sage treats the download and manual installation as a mandatory security measure, not an optional maintenance task.

The fault lies in several certificates issued by a Certificate Authority called eMudhra. Sage said the certificates contain weak, easily guessable private keys. They serve as trust anchors within certificate chains used to verify access to websites; under the right circumstances, the weak keys can support spoofing of domain names.

Price said IT organizations worldwide are blocking or removing the affected root certificates. That action extends beyond the U.S. radio deployments covered by the firmware alert, but it does not change the stated eligibility for the update: U.S. model 3644 units on Rev96 or Rev96-1.

Version 96-2 also addresses two operational issues separate from the certificate flaw. It resolves SMTP email attachment compatibility problems with some mail servers, and it allows the use of “&” and “+” in web GUI passwords. Those changes sit alongside the certificate removal in the same free firmware package, and users still need to install that package manually.

Price separated the certificate issue from two other operational concerns discussed at the time. He said Thursday evening:

“It is unfortunate that this issue was discovered close to the National Periodic Test and the PHP problem. However, the three items are not related. The ENDEC does not use PHP, but we do have the eMudhra root certificates that were in common use.”

The practical sequence is direct: confirm that the unit is a U.S. model 3644, check that it runs Rev96 or Rev96-1, download version 96-2 from Sage and install it locally. Sage said its support team can assist users who are unfamiliar with the procedure.

Sage has published Rev 96-2 release notes and a Rev 96-2 download page for the manual update.

The immediate rollout task for affected U.S. stations is manual installation of version 96-2, with Sage support available; the alert sets no fixed installation date beyond the FCC requirement for prompt updates.