SG 5 Update #19

Note:

• • Resolved critical Linux Kernel Vulnerability CVE-2026-98432.
• • Fixed the issue where a config restore operation triggered from the ASP reports an error

Package name: 19.SG5000_base-sys-hotfix-20261103-01.pkg

MD5 checksum: 81525232096d3916eb9d657734f43106

File size: 449 KB

Release date: 3 November 2026

ASP 2.0 Update #9
Release Date: 23 October 2026

ASP 2.9.3

Security Fixes

• Resolved critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109169.

ASP 2.9.2

Enhancements and Changes

• Added static time-zone support for America/Winnipeg, America/Vancouver, and America/Edmonton, allowing these time zones to operate without Daylight Saving Time (DST) adjustments.
• Improved database data retention and cleanup mechanisms.
• Improved the captive portal consent flow and layout to ensure users review and accept the required consent before connecting.
• Added search functionality to the site selection interface used for Duplicate Backup, making it easier to locate sites in environments with large numbers of sites.
• Fixed an issue where report downloads under Global Account could remain stuck in the GUI.
• Added a new Access Code Usage Report to provide usage information for access codes.
• Enhanced ASP Site Management by allowing the Site Description field to be resized, making longer descriptions easier to view and edit.
• Enhanced Global Plans to support configuration of the device sharing limit across all supported plan types.

Bug Fixes

• Fixed an issue in PMS authentication configuration that prevented added non-VIP plans from being removed.
• Fixed an issue affecting the responsiveness of Social Login buttons on the Captive Portal.
• Fixed an issue in the RMS Cloud REST API PMS integration where VIP authentication could return a “Guest Not Found” error when authenticating using the guest’s last name.
• Fixed an issue in ASP Admin Site Management where the site address could be displayed incorrectly or be missing from the Home Page.
• Fixed an issue affecting scheduled report generation and transfer for some organizations.
• Fixed an issue where repeatedly selecting Send Email on the Captive Portal could result in multiple OTP emails being sent.
• Fixed failures affecting Transaction Report downloads.
• Improved Global Account search accuracy so that searches using an exact User ID do not return unrelated results.
• Fixed failures affecting Session Report downloads.
• Updated the ASP Transaction page so that an unavailable Billing ID is displayed as an empty value instead of “0”.
• Improved the non-VIP plan upgrade confirmation popup by providing clearer Yes and No action buttons.
• Fixed a time discrepancy between information displayed in the ASP GUI and downloaded reports.
• Fixed an ASP permission issue where restricted Delete Expired Global Account and Delete Expired Global Code options could remain visible in the GUI.
• Fixed an issue where an incorrect session end time could be displayed in the Session Report
• Fixed an issue where attempting to edit a non-existent Global Plan returned a 500 Internal Server Error instead of a 404 Not Found response.
• Improved site deletion processing by handling delete operations asynchronously, reducing the possibility of Gateway Timeout errors when deleting sites.
• Improved the responsiveness of report and diagnostic pages by preventing administrative sessions from being locked during long-running requests.
• Fixed an issue where the name and email address of users authenticated through social media were not displayed in User Details.

Security Fixes

• Updated OpenSSH components to address the following security vulnerabilities;
  •  CVE-2025-32728
  • CVE-2025-61984
  • CVE-2025-61985
  • CVE-2026-35414
  • CVE-2026-35386
  • CVE-2026-35385
  • CVE-2026-35387
  • CVE-2026-35388

ASP 2.9.1

Bug Fixes

• Fixed an issue where the header row was missing from the downloaded monthly license usage report.
• Fixed an issue where checking the casting report resulted in a 500 Internal Server Error.
• Fixed an issue where the Org Super Admin could not see a newly created site.
• Fixed a “404 Not Found” error when downloading reports from Report & Analytics > Downloads.
• Fixed an issue where the Terms and Conditions consent popup did not support scrolling for long content.

APIs

• Fixed an issue where the Org Super Admin could not see a newly created site.

ASP 2.9.0

Enhancements and Changes

• Added terminal access to the cast server, enabling access from the ASP GUI.
• Added an option in the GUI to end guest sessions from the server side.
• Added a timezone field to the organization add and edit form.
• Added a new menu switcher in the ASP GUI to navigate between different hospitality services.
• Added a description field in the site list, allowing users to add notes for each site.

Bug Fixes

• Fixed an issue where the TruAuth Report service would repeatedly restart due to an internal error.
• Fixed an issue causing duplicate OTP emails to be sent.
• Fixed an issue where the client logo was not displayed in OTP emails.
• Fixed an issue where the built-in portal background image did not display after uploading a new image.
• Fixed an issue where the location portal welcome page banner could not be disabled or removed once enabled.
• Fixed an issue preventing custom landing page configuration when HTTPS was enabled, which caused portal save failures.
• Fixed an issue where background images and icons uploaded for TV display were not taking effect.

APIs

• Introduced new APIs to manage VLANs, including creating, updating, deleting, and retrieving single or multiple VLANs.
• Added new APIs to manage plans, allowing users to create, update, delete, and retrieve individual or all plans.
• Added new APIs to duplicate and delete locations.
• Added a new API to duplicate a site and check duplication status.
• Added a new API to update room devices.
• Enhanced the API for retrieving all portals to include additional output fields for site name and zone.
• Added a timezone field in the Organization Add, Update, Get, and Get All APIs.

ANTlabsEzCast Update #6

[Click here to read more]

RELEASE DATE: 23 October 2026

SG 5 Update #18

Note:

• • Resolved critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
  • Upgraded the PHP interpreters to apply the required security remediation.
  • Restarted long-running PHP processes to ensure the updated PHP version takes effect
  immediately.
  • In High Availability (HA) deployments, the update is automatically applied to the connected
  peer gateway.

Package name: 18.SG5000_base-sys-hotfix-20261022-01.pkg

MD5 checksum: 118a76479706cf891cecf7c405e21f81

File size: 29 MB

Release date: 22 October 2026

ASP 2.0 Update #9
Release Date: 07 October 2026

ASP 2.9.2

Enhancements and Changes

• Added static time-zone support for America/Winnipeg, America/Vancouver, and America/Edmonton, allowing these time zones to operate without Daylight Saving Time (DST) adjustments.
• Improved database data retention and cleanup mechanisms.
• Improved the captive portal consent flow and layout to ensure users review and accept the required consent before connecting.
• Added search functionality to the site selection interface used for Duplicate Backup, making it easier to locate sites in environments with large numbers of sites.
• Fixed an issue where report downloads under Global Account could remain stuck in the GUI.
• Added a new Access Code Usage Report to provide usage information for access codes.
• Enhanced ASP Site Management by allowing the Site Description field to be resized, making longer descriptions easier to view and edit.
• Enhanced Global Plans to support configuration of the device sharing limit across all supported plan types.

Bug Fixes

• Fixed an issue in PMS authentication configuration that prevented added non-VIP plans from being removed.
• Fixed an issue affecting the responsiveness of Social Login buttons on the Captive Portal.
• Fixed an issue in the RMS Cloud REST API PMS integration where VIP authentication could return a “Guest Not Found” error when authenticating using the guest’s last name.
• Fixed an issue in ASP Admin Site Management where the site address could be displayed incorrectly or be missing from the Home Page.
• Fixed an issue affecting scheduled report generation and transfer for some organizations.
• Fixed an issue where repeatedly selecting Send Email on the Captive Portal could result in multiple OTP emails being sent.
• Fixed failures affecting Transaction Report downloads.
• Improved Global Account search accuracy so that searches using an exact User ID do not return unrelated results.
• Fixed failures affecting Session Report downloads.
• Updated the ASP Transaction page so that an unavailable Billing ID is displayed as an empty value instead of “0”.
• Improved the non-VIP plan upgrade confirmation popup by providing clearer Yes and No action buttons.
• Fixed a time discrepancy between information displayed in the ASP GUI and downloaded reports.
• Fixed an ASP permission issue where restricted Delete Expired Global Account and Delete Expired Global Code options could remain visible in the GUI.
• Fixed an issue where an incorrect session end time could be displayed in the Session Report
• Fixed an issue where attempting to edit a non-existent Global Plan returned a 500 Internal Server Error instead of a 404 Not Found response.
• Improved site deletion processing by handling delete operations asynchronously, reducing the possibility of Gateway Timeout errors when deleting sites.
• Improved the responsiveness of report and diagnostic pages by preventing administrative sessions from being locked during long-running requests.
• Fixed an issue where the name and email address of users authenticated through social media were not displayed in User Details.

Security Fixes

• Updated OpenSSH components to address the following security vulnerabilities;
  •  CVE-2025-32728
  • CVE-2025-61984
  • CVE-2025-61985
  • CVE-2026-35414
  • CVE-2026-35386
  • CVE-2026-35385
  • CVE-2026-35387
  • CVE-2026-35388

ASP 2.9.1

Bug Fixes

• Fixed an issue where the header row was missing from the downloaded monthly license usage report.
• Fixed an issue where checking the casting report resulted in a 500 Internal Server Error.
• Fixed an issue where the Org Super Admin could not see a newly created site.
• Fixed a “404 Not Found” error when downloading reports from Report & Analytics > Downloads.
• Fixed an issue where the Terms and Conditions consent popup did not support scrolling for long content.

APIs

• Fixed an issue where the Org Super Admin could not see a newly created site.

ASP 2.9.0

Enhancements and Changes

• Added terminal access to the cast server, enabling access from the ASP GUI.
• Added an option in the GUI to end guest sessions from the server side.
• Added a timezone field to the organization add and edit form.
• Added a new menu switcher in the ASP GUI to navigate between different hospitality services.
• Added a description field in the site list, allowing users to add notes for each site.

Bug Fixes

• Fixed an issue where the TruAuth Report service would repeatedly restart due to an internal error.
• Fixed an issue causing duplicate OTP emails to be sent.
• Fixed an issue where the client logo was not displayed in OTP emails.
• Fixed an issue where the built-in portal background image did not display after uploading a new image.
• Fixed an issue where the location portal welcome page banner could not be disabled or removed once enabled.
• Fixed an issue preventing custom landing page configuration when HTTPS was enabled, which caused portal save failures.
• Fixed an issue where background images and icons uploaded for TV display were not taking effect.

APIs

• Introduced new APIs to manage VLANs, including creating, updating, deleting, and retrieving single or multiple VLANs.
• Added new APIs to manage plans, allowing users to create, update, delete, and retrieve individual or all plans.
• Added new APIs to duplicate and delete locations.
• Added a new API to duplicate a site and check duplication status.
• Added a new API to update room devices.
• Enhanced the API for retrieving all portals to include additional output fields for site name and zone.
• Added a timezone field in the Organization Add, Update, Get, and Get All APIs.

ANTlabsEzCast Update #5

[Click here to read more]

RELEASE DATE: 11 Sept 2026

SG 5 Update #17

Note:

• It is recommended to reboot the gateway (via Admin GUI or CLI) after applying this update in order for some of the fixes to apply, namely the CVE-2026-31431 vulnerability fix and the network performance tuning.
• This update comes with HA-specific features:
  • This update will apply automatically to the connected HA peer if the peer is already at 16 or 17 update level.
  • If the connected peer’s update level is lower than 16 or higher than 18, the update will abort prematurely and not apply anything on either machine.

This update includes the following enhancements:

• Add Microsoft Graph API support for sending email
• Allows a static destination-based route out Management Port or one of the WAN links to specify its source IP behaviour:
  • Use Floating IP,
    • Selecting this allows packets following this static route out the specified interface to pick up the floating IP as the source IP
      • Note: if floating IP is disabled, this route will not be brought up.
  • Use Physical IP, or
  • Default (will use physical IP, even in the presence of floating IP)
• SMPP Settings GUI enhanced to allow configuration of more fields that are sent to the configured SMPP server
  • New fields added: Source/Destination Type of Number (TON) and Numbering Plan Identification (NPI)
• PMS enhancement:
  • Cybersource – Logs API messages inside PHP log (/log/php/php.log) for enhanced troubleshooting
• Security enhancements:
  • Prevents various kernel vulnerabilities: CVE-2026-43284, CVE-2026-43500, CVE-2026-46300, CVE-2026-31431, CVE-2026-31635
• Web server enhancements:
  • Improved stability
  • Resolved some vulnerabilities: CVE-2026-42945, CVE-2026-49975
• Network performance tuning
  • Set RX/TX ring buffer size of LAN and WAN network ports to the maximum values allowed by the hardware
• Client Manager update for improved ARP responsiveness in the rare situation where database becomes sluggish

This update contains the following fixes:

• Networking-related fixes:
  • Fixed network device’s permanent ARP entry not being brought up when its associated WAN interface is brought down and then up
  • Fixed some static routes not being brought up when interface is brought up, e.g. upon system power-up
  • Fixed source route becoming disabled when the floating IP of the associated WAN link is turned off
  • Moved unauthenticated users to a dedicated QoS tier enjoying the full bandwidth allowed by the gateway. This resolved the issue where unauthenticated users are not getting landing page when the None QoS tier is already heavily utilized by authenticated users.
  • Fixed downstream users in a QoS class (with no per-client/account rate limit) experiencing slowness when there are many users in the same QoS class
• Fixes for downstream authentication:
  • Fixed MAC-blocked device gaining internet access under an auto-login location
  • Shiji PMS – Resolved the issue where guest info retrieval fails, returning an “Invalid filter syntax” error
• Admin GUI fixes:
  • Fixed load-balancer monitor page not showing weight and other data in the right order
  • Fixed not being able to disable an existing user account
  • Fixed port forwarding editor panel always showing LAN NO VLAN for an existing port forwarding rule that is not going through LAN NO VLAN
  • Fixed date search for various listing pages: accounts, device monitor, device log, credit card log, admin audit log.
  • Added admin audit trail for editing of WAN Firewall rules
  • Resolved the issue where adding a pre-existing static route that is not through LAN caused the interface selection to toggle to LAN in the response page
• Fixed not being able to clean up session log entries when there are a huge number of them
• Fixed not being able to retrieve software version information from HA peer when HA peer is under certain SSH load.
  • This resolved the issue where ASP wrongly determined that there was software version mismatch between the HA nodes and sent out notification emails.
• Fixed a rare problem where lawful intercept did not start logging upon service start
• Fixed malformed SMPP packet sent out by the gateway
• Fixed GUI-triggered Change HA ID causing the machine to get stuck in the passive mode

Package name: 17.SG5000_base-sys-bulk08-20260430-01.pkg

MD5 checksum: 863e7a23d96315c400ae62bd7736d8b3 (updated 21 Sep)

File size: 130 MB

Release date: 2 July 2026

ASP 2.0 Update #9
Release Date: 10 June 2026

ASP 2.9.1

Bug Fixes

• Fixed an issue where the header row was missing from the downloaded monthly license usage report.
• Fixed an issue where checking the casting report resulted in a 500 Internal Server Error.
• Fixed an issue where the Org Super Admin could not see a newly created site.
• Fixed a “404 Not Found” error when downloading reports from Report & Analytics > Downloads.
• Fixed an issue where the Terms and Conditions consent popup did not support scrolling for long content.

APIs

• Fixed an issue where the Org Super Admin could not see a newly created site.

ASP 2.9.0

Enhancements and Changes

• Added terminal access to the cast server, enabling access from the ASP GUI.
• Added an option in the GUI to end guest sessions from the server side.
• Added a timezone field to the organization add and edit form.
• Added a new menu switcher in the ASP GUI to navigate between different hospitality services.
• Added a description field in the site list, allowing users to add notes for each site.

Bug Fixes

• Fixed an issue where the TruAuth Report service would repeatedly restart due to an internal error.
• Fixed an issue causing duplicate OTP emails to be sent.
• Fixed an issue where the client logo was not displayed in OTP emails.
• Fixed an issue where the built-in portal background image did not display after uploading a new image.
• Fixed an issue where the location portal welcome page banner could not be disabled or removed once enabled.
• Fixed an issue preventing custom landing page configuration when HTTPS was enabled, which caused portal save failures.
• Fixed an issue where background images and icons uploaded for TV display were not taking effect.

APIs

• Introduced new APIs to manage VLANs, including creating, updating, deleting, and retrieving single or multiple VLANs.
• Added new APIs to manage plans, allowing users to create, update, delete, and retrieve individual or all plans.
• Added new APIs to duplicate and delete locations.
• Added a new API to duplicate a site and check duplication status.
• Added a new API to update room devices.
• Enhanced the API for retrieving all portals to include additional output fields for site name and zone.
• Added a timezone field in the Organization Add, Update, Get, and Get All APIs.

ANTlabsEzCast Update #4

[Click here to read more]

RELEASE DATE: 8 June 2026

SG 5 Update #16

This update fixes the PMS guest login issue where the Matching First X Characters has been configured but the downstream guest fails to login with the first X characters of the guest name/number.

Release Date: 6 March 2026
Package Name:16.SG5000_base-sys-hotfix-20260305-01.pkg
MD5 checksum: 9f3e677de07b1479875b9e9fdb3e70aa (updated 20 Apr 2026)
File size: 322 KB