[SBE-89-Alaska] IMPORTANT NOTICE: Sage Rev96-2

[Paul Jewusiak]

Updated Sage ENDEC software available.



Thank you,
Paul Jewusiak



---------- Forwarded message ---------
From: Sage Alerting Systems <support at sagealertingsystems.com>
Date: Thu, Nov 5, 2026, 3:33 PM
Subject: Sage Rev96-2
To: <radiopaul289 at gmail.com>


Required Update


November 5, 2026


This message is from Sage Alerting Systems regarding your Sage Digital
ENDEC model 3644. It applies only to users in the United States.


Sage Alerting Systems has released a free firmware update, version 96-2
(also known as 96-02), for US users running Rev96 or Rev96-1. This update
contains a security update, and is mandatory. Per FCC 47 CFR 11.35(d)(2),
security updates must be installed promptly (see below for more
information).


Version 96-2 removes compromised eMudhra root certificates used to secure
TLS connections for alert audio servers. This release also resolves SMTP
email attachment compatibility issues with some mail servers and allows the
use of '&' and '+' in web GUI passwords.


Please review the release notes and download the update using the links
below:

 - Release Notes:
https://www.sagealertingsystems.com/rev96-2-release-notes.pdf

 - Download Page: https://www.sagealertingsystems.com/rev96-2download.html


You must install this update. Installation is easy for ENDECs already
running any version of Rev96, see the release notes.


Additional information:


The primary security issue is the eMudhra Certificate Authority (CA)
problem. This CA issued trusted root certificates, but mistakenly issued
certificates in their hierarchy with a weak key that could be easily
guessed, allowing the creation of false certificates that can masquerade as
any domain. This affects computer systems worldwide. The ENDEC uses CA
certificates to validate TLS (https) connections to web servers, including
alert audio servers.


To mitigate this issue, the IT industry is removing the affected eMudhra
roots and cross-signing certifications from trust lists. While operating
systems and browsers on desktop equipment have likely been updated
automatically, the Sage ENDEC does not perform automatic software updates.
To remove the at-risk certificates, you must manually install our 96-2
update.


The FCC rules state: “11.35(d)(2) Install security patches and
security-related software and firmware updates issued by equipment
manufacturers promptly after those patches or upgrades become available.
Security patches and security related software and firmware updates issued
by equipment manufacturers may be tested before they are installed,
provided that the testing begins promptly and is completed in a timeframe
that is consistent with industry best practices”


This is a free update for any ENDEC running Rev96 or Rev96-1. All active
Sage ENDECS should already have been running at least the Rev96 version,
issued in February 2024, to stay compliant with FCC Part 11 rules.


For questions, please email us at support at sagealertingsystems.com or call
914-872-4069 and press 1 for support. If prompted, please leave a message
and we will return your call.


----------------------------------

You received this message because you sent an email to our support address
asking to be added to our list, clicked the subscribe button on our support
web page, or supplied an email address when you returned the warranty
postcard shipped with the ENDEC. If you wish to be removed from our email
list, click on the unsubscribe link below.



Sage Alerting Systems | 800 Westchester Avenue Suite 641 North | Rye Brook,
NY 10573 US

Unsubscribe
<https://audience.constantcontact.com/preferences/unsubscribe?m=00103JE7AJ30A8ODohbqt30KA==&c=33b4e9d0-b2b1-11e8-ba3d-d4ae529a826e&ca=65853883-8e2f-4360-a26c-7868aa5118b4>
| Update Profile
<https://audience.constantcontact.com/preferences/update/init?ch=33d7db20-b2b1-11e8-ba40-d4ae529a826e&c=33b4e9d0-b2b1-11e8-ba3d-d4ae529a826e&t=001gMvCVEGcOjpOXZcHADgDPQ==&m=00103JE7AJ30A8ODohbqt30KA==&ca=65853883-8e2f-4360-a26c-7868aa5118b4>
| Constant Contact Data Notice
<https://www.constantcontact.com/legal/customer-contact-data-notice>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://sea.sbe16.org/pipermail/sbe-89-alaska/attachments/20261105/96e2dc40/attachment-0001.html>