v1.5.26 Bug Reports and Comments

[Stephen]

Latest WS Stable Release: v1.5.26

Big shoutout to PeiHuang! He delivered the most sophisticated bug report I've ever seen which made it very easy for us to prove and test the vulnerability that ultimately lead to this release.


***NOTE:
WILL RESET PASSWORD BACK TO DEFAULT PASSWORD "admin" WHEN UPGRADING SO YOU MUST RESET PASSWORD AFTER UPGRADE IF UPGRADING FROM BELOW 1.5.17
(including 1.5.17rc2)


***NOTE:

Some people use a smart power strip that will reboot a switch if pings stop.
This upgrade process can take longer than normal due to a lot of house
keeping from the vast changes in code. So if the unit is power cycled
during the upgrade it is bricked. Make sure to disable this or increase
time missing pings till reboot 10 minutes or more.



***NOTE (Smart DC Switches):

On the original 1.5.17 release, it was noted that certain DC models could get bricked.
It appears that during firmware ugprade, sometimes it will also upgrade the firmware on the power supply which was being blocked by a failed semaphore init. This could easily have been corruption on download or possibly upload. But we have also added additional checks in an attempt to circumvent this issue should it appear again.
HOWEVER,
especially for smart DC models. We suggest you upgrade one that is easy for you to access in case anything goes wrong FIRST. Then continue
rollout if all goes well.




FIXED/CHANGED
- lighttpd upgraded - 1.5.17rc1
- Openssl upgraded - 1.5.17rc2
- Upgrade failure on very old WS models -1.5.17rc2
- Patched security holes to prevent hacking, however you should always use the Access Control List as good practice. - 1.5.17
- Removed PHP replaced with compiled binaries (approximately 60,000 lines of code needed re-written) - 1.5.17
- Greatly improved SFP compatibility and Stability where you saw SFPs not come up after upgrades and reboots - 1.5.17
- Fixed potential multi reboots due to certian configurations during warm boots and firmware upgrades - 1.5.17
- Fixed NTP - 1.5.17
- Fixed SNMP memory leak - 1.5.17
- Upgraded password hash (WILL RESET PASSWORD BACK TO DEFAULT "admin"
WHEN UPGRADING REQUIRES PASSWORD RESET AFTER UPGRADE IF PREVIOUS VERSION
IS BELOW 1.5.17) - 1.5.17
- Upgraded session hash algorithm - 1.5.17
- Fixed MAC table lookup and updated to latest vendor list - 1.5.17
- NTP scripts fixed - 1.5.18
- fixed special characters (aka !#@, etc) during login - 1.5.18
- checks added during boot for smart i2c supply BE CAUTIOUS WHEN UPGRADING SMART DC SWITCH'S (WS-12-250-DC, WS-8-150-DC, etc) - 1.5.18
- ssh login now only accepts correct password - 1.5.19
- VLAN's and other variable length conf items no longer limited - 1.5.20
- If greater than 30 VLAN they will now be applied correctly - 1.5.21
- Radius login fixed - NOTE, POSSIBLE SECURITY HOLE FOUND IN ORIGINAL IMPLEMENATION (pre-1.5.17) - 1.5.21
- Autobackup filenames fixed - 1.5.21
- DHCP fixed - 1.5.22
- web conf check command fixed - 1.5.22
- SMTP From Address now used when populated, otherwise defaults to switch ip - 1.5.22
- Ingress/Egress Throughput samples now account for delays lasting longer than a second, preventing weird spikes on port status - 1.5.22
- Memory corruption spikes on smart DC switch Input Voltage graphs looks fixed after 24 hour testing, please report if more are seen - 1.5.22
- NTP enable/disable will now trigger update immediately - 1.5.23
- SSH Key length extended to 1000 characters to accommodate common algorithms - 1.5.23
- WebUI Sessions can now expire, but will remain open with the webui - 1.5.23
- Multicast Configuration bug fix, this is potentially responsible for spontaneous issue's that have been reported with SFP's, PPPoE, OSPF, etc but due to testing complexity we cannot be certain, please let us know if you see any improvements if you have been experiencing these problems
- 1.5.23
- SMTP will now handle from address more intuitively - 1.5.24
- NTP update bug causing failures on config changes and incorrectly triggering revert timer fixed - 1.5.24
- SMTP test when FromAddress empty now works - 1.5.25
- PingWatchdog alert GPS corruption fixed - 1.5.25
- false alert about the switch rebooting has been fixed - 1.5.25
- Traceroute resolve ips checkbox fixed - 1.5.25
- MSTP bug fix - 1.5.25
- StormControl bug fix - 1.5.25
- VLAN issue regarding trunked ports fixed - 1.5.25
- Multicast over SFP's fixed - 1.5.25 - WE SUSPECT THIS WAS RESPONSIBLE FOR ISSUES REPORTED FOR OSPF AND PPPOE PLEASE POST IN THIS THREAD IF YOU STILL SEE ISSUES
- Fix critical security vulnerability allowing for potential remote execution - 1.5.26


ENHANCEMENTS
- UI works faster as it is binary verses PHP - 1.5.17

KNOWN ISSUES
- FreeRADIUS is BROKEN
- WEB UI issues when not at 100% Zoom on browser especially on VLAN TAB
- Some language templates need help

Released 11/08/2025

[Stephen]

We are still under heavy development for the WS4 but we got a report about a severe vulnerability still floating around on the WS series.

After testing, I was able to confirm it, Obviously, we still take security very seriously so 1.5.26 is now available and it fixes the reported issue.
We do suggest you upgrade as soon as possible. Especially if your switches are at all exposed to the net!

[mnitech]

Successfully upgraded my two test bench systems (WS-12-250-AC and WS-12-250-DC). The other units will be upgraded based on on-site tech availability.

[lligetfa]

Upgraded one WS-24-400A, no drama.

[sakita]

No problem upgrading 27 switches (12 @ WS-8-150-AC, 13 @ WS-8-150-DC, and 2 @ WS-12-250-DC). Will let you know if anything crops up.

[passwd26]

This looks really cool! I have upgraded the firmware to version v1.5.26 and tested it again; the vulnerability has been fixed. I also tried to identify any new vulnerabilities but haven't discovered any yet. I would like to thank Chris, Stephen, and the Netonix team for their hard work.

Additionally, I want to assure you that any vulnerabilities I submit will be kept strictly confidential and will not be used for any illegal activities.

Best wishes!

Pei Huang (黄培).

[Flo]

Thank you @PeiHuang and @Netonix for your outstanding work. Last weekend I remotely upgraded all our Netonix devices to v1.5.26 with no issues so far. Awaiting the upcoming 2.5G product line.

[mrmarria]

cannot calibrate! [img]Y:\Dark%20Alley\2025\Red%20Coyote%20LLC\Wisp\Hardware\Power%20&%20Solar\NetoniX\ws-8-150-dc.png[/img]How do I fix this? Updated to 1.5.26 - same result

[sirhc]

The unit is damaged. RMA it at rma.netonix.com

[mrmarria]

Thanks for the quick reply!
Whoa, what happened? I think it is likely out of warranty? Unless there is some exception for this issue?