RDX QuikStation Security Patch 2026-10

The root fix for these vulnerabilities can only be applied to the latest firmware, 3.3.0.5, so this patch includes the update to firmware 3.3.0.5. (The patch itself can be run on every firmware version.)

Distribution page for the security patch for the web management interface of the RDX QuikStation 4 / QuikStation 8 / QuikStation8_10G (php2shell, CVE-2026-109618 / CVE-2026-109619).

Download

QS-SecurityFix-2026-10-v13.zip (complete patch: mitigation + PHP fix + firmware 3.3.0.5, 98 MB)
SHA-256: 6adde2c56fb7be9b599007037e80e73d13014779d5269e8617630f4ba849372c
Bulletin (English) QuikStation_SecurityPatch_2026-10_en.pdf
Bulletin (Japanese) QuikStation_SecurityPatch_2026-10_ja.pdf
SHA256SUMS.txt (checksums of the files above)

See the bulletin for instructions. On Windows, extract the zip, put the unit's key file in the same folder and run QS-SecurityFix.bat. On units with firmware older than 3.3.0.5 the update to 3.3.0.5 (unit reboot) is performed automatically.

Tandberg Data — 2026-10