QuikStation Security Patch 2026-10
==================================

WHAT THIS IS

  A configuration-only security patch for the web management interface
  (Apache / PHP) of the RDX QuikStation 4, QuikStation 8 and
  QuikStation8_10G, all firmware
  versions: 1.x, 2.x and 3.x. The firmware generation is detected
  automatically (on 1.x there are no A/B boot areas and the TLS profile is
  TLS 1.2 only). It contains the PHP-project mitigations for the critical
  "php2shell" vulnerabilities (CVE-2026-109618, CVE-2026-109619) and a set
  of web-server / TLS / PHP hardening settings. See the bulletin (PDF) for
  the full list of what is and is not addressed.

  It does NOT update the firmware, does NOT reboot the unit, and does NOT
  affect backups, iSCSI connections or the network link. The web console
  restarts for a few seconds when the patch is applied.

FIRMWARE UPDATES AND THE PATCH

  An update from 1.x to 2.x or later removes the patch completely (the
  unit is simply back in the "not patched" state). An update between
  2.x / 3.x versions keeps the patch active, but the rewritten boot area
  loses its own copy, so run the patch once more after the update. If you
  plan to update, update to the final firmware 3.3.0.5 first and apply the
  patch afterwards.
  - Currently on 2.5.2 or later (2.x / 3.x): update to 3.3.0.5 first, then
    apply. If no update is planned, apply to the current firmware.
  - Currently on 1.5.1.26 or earlier (1.x): reaching 3.3.0.5 is a
    three-step procedure (details at the link below), so apply the patch to
    the current firmware first to protect the unit now. The update to 2.5.2
    or later removes the patch - apply it again after that update (if the
    three steps are done in one session, once after reaching 3.3.0.5 is
    enough).
    https://drive.google.com/file/d/1C4yG0U92Van-UYk4u5ptwxw-rBgTesYe/view?usp=sharing
  In every case, run --status after a firmware update and re-apply when it
  reports "RESULT: NOT INSTALLED".

WHAT YOU NEED

  - SSH enabled on the QuikStation (web console: System Settings > Options
    > Diagnostics > Allow Remote Access (SSH)) and the key file downloaded
    from that same tab. Each unit has its own key.
  - The unit's address (the one you use for the web console).

WINDOWS (one click)

  1. Save the key file into THIS folder, next to QS-SecurityFix.bat.
  2. Double-click QS-SecurityFix.bat.
  3. Enter the unit's address, then type YES when asked.
  4. The run ends with "RESULT: PROTECTED".

  Check only:   QS-SecurityFix.bat <address> /STATUS
  Undo:         QS-SecurityFix.bat <address> /RESTORE
  Nothing is installed on the PC; plink.exe / pscp.exe (PuTTY) are used
  from this folder and the Windows registry is not touched. Windows 7+.

macOS / LINUX

  ./qs-secfix-apply.sh <address> <key-file>             apply
  ./qs-secfix-apply.sh <address> <key-file> --status    check only
  ./qs-secfix-apply.sh <address> <key-file> --restore   undo

  Or manually:
    scp -i <key-file> qs-secfix.sh vtx@<address>:/tmp/
    ssh -i <key-file> vtx@<address> "sh /tmp/qs-secfix.sh"

AT THE UNIT (console or USB stick)

  Copy qs-secfix.sh to a FAT32 USB stick, log in on the console as vtx,
  mount the stick (mount -t vfat /dev/disk/by-label/<LABEL> /mnt/usb) and run
    sh /mnt/usb/qs-secfix.sh
  Do not open qs-secfix.sh in Notepad - it breaks the file.

AFTER APPLYING

  - "sh qs-secfix.sh --status" must report RESULT: PROTECTED.
  - Connecting to the web console now requires TLS 1.2 or later.
  - If the new configuration prevented the web server from starting, the
    patch rolls itself back automatically and says so.
  - The patch survives reboots (on 2.x/3.x it is stored in both firmware
    areas). After any firmware update run --status and run the patch once
    more (a 1.x -> 2.x update removes it; a 2.x/3.x update keeps it).
  - Disable SSH on the unit again in the web console when finished.

FILES

  QS-SecurityFix.bat    Windows launcher (one click)
  qs-secfix.sh          the patch itself, run on the unit
  qs-secfix-apply.sh    macOS / Linux launcher
  plink.exe, pscp.exe   SSH programs (PuTTY project), used by the .bat
  qs-keyconv.ps1        converts the unit's key file for plink
  PUTTY-LICENCE.txt     licence of the two PuTTY programs
  README.txt / README-ja.txt    this file
  SHA256SUMS            checksums, to confirm the files are intact
