Sage Issues Mandatory Security Update for ENDECs

Sage Alerting Systems is requiring U.S. users of certain Digital ENDEC units to install firmware version 96-2 to remove compromised root certificates.

Updated on Nov. 6, 2026 in Cybersecurity

Isometric editorial illustration of a single dark gray rack-mounted metal unit with vent slots and one green indicator light on a clean surface. — Sage Alerting Systems is requiring U.S. users of certain Digital ENDEC units to install firmware 96-2 to remove compromised eMudhra root certificates. AI Illustration. Upload story photo >

Sage Alerting Systems has notified users of Sage Digital ENDECs of a mandatory security update, version 96-2, which removes compromised eMudhra root certificates used to secure TLS connections for alert audio servers. The update applies to Digital ENDEC model 3644 and only to U.S. users running Rev96 or Rev96-1.

Why it matters

The update is required under the FCC's recent rules change requiring prompt installation of security updates. The affected eMudhra certificates have weak, easily guessable private keys that could, in the right circumstances, be used to spoof domain names.

The free firmware update is version 96-2 (also written 96-02) and applies to Digital ENDEC model 3644 running Rev96 or Rev96-1. Version 96-2 also resolves SMTP email attachment compatibility issues with some mail servers and allows the use of "&" and "+" in web GUI passwords, while the number of affected units remains unstated.

The players

Sage Alerting Systems

Sage Alerting Systems is a manufacturer of emergency alert equipment, including the Sage Digital ENDEC used to receive and relay Emergency Alert System messages.

Federal Communications Commission

The Federal Communications Commission is the U.S. federal agency that regulates interstate and international communications, including the Emergency Alert System rules that the update must satisfy.

The details

Sage Alerting Systems' Sage ENDEC does not update its software automatically, so users must manually install the update. Version 96-2 removes eMudhra root certificates that are a trust anchor for certificate chains used to verify access to websites, and IT organizations worldwide are blocking or removing the affected certificates.

February 2024: Rev96 version issued to maintain FCC Part 11 compliance.
November 6, 2026: Sage announced the mandatory security update for ENDECs.

Roadmap

The update is a direct compliance response to the FCC's recent rules change requiring prompt installation of security updates for Emergency Alert System equipment. It shows how federal communications rules are now pushing broadcast alert hardware makers to patch certificate-level weaknesses on a fixed timeline rather than at their own discretion.

U.S. owners of affected Digital ENDEC model 3644 units must manually install firmware version 96-2 because the device does not update itself. Until the update is installed, the compromised certificates remain in place, and users running older Rev96 or Rev96-1 firmware should prioritize the install.

The takeaway

Owners of Sage Digital ENDEC equipment should check their firmware revision and install version 96-2 promptly, since manual installation is required. Keeping emergency alert hardware patched is now a compliance matter under FCC rules, not just a best practice.