Skip to content

Version 26.02.02

October 2026 · API v34

Security maintenance release of 26.02, following a penetration test. It includes all the changes of the intermediate 26.02.01 build (September 2026), listed below as well.

New Features

  • (26.02.01) Basic authentication can now be restricted to a configurable allow-list of trusted IP addresses or subnets.

Fixes

26.02.02

  • Breaking change: the controller's web server now only serves the DOMConnect API and the DOMPloy download page; the other files of the web root are no longer reachable over HTTP. As a consequence, the legacy OSS SOAP web service (oss-so.php) is no longer available.
  • Prevents OS command injection through the log settings (max-logs-size / max-history-days on POST /api/config/logs), which now only accept whole numbers.
  • Leftover files (a phpMyAdmin copy, licenses.php and development artefacts) are now removed from the web server during the update.
  • An unused third-party PHP library (ACL manager) is removed from the controller, including on existing installations during the update.
  • Changing the master user's password from DOMPloy no longer fails when the request sends back the user's current roles (POST /dombox/v2/user/{id}).

26.02.01 (September 2026)

  • Prevents OS command injection on the dombox/change-password endpoint.
  • Eliminates SQL injection vectors by enforcing parameterized queries across the API.
  • Removes a local privilege-escalation path in the dom-box-config-wrapper utility.
  • Adds brute-force protection (rate limiting and account lockout) on API login.
  • Passwords and Bearer tokens are now redacted from DEBUG-level logs.
  • API error messages are now generic and no longer expose internal paths or technical details.
  • Installed package and version details are no longer freely disclosed.
  • The log-download endpoint now only serves the intended log archive.
  • Web-root permissions are hardened: the web user can no longer write to the application code.

DOMPloy 6.4.1

  • The minimum password length is raised to 12 characters (complexity rules unchanged).
  • The current user's password is no longer sent in user-management requests.

Known Issues

No known issues for this version.

Download

Files are hosted on the DOM Security SharePoint (sign-in required): DOMConnect v.26.02.02 folder. This release only ships the controller packages; DOMPloy, DOM Service and the mesh firmware come from the DOMConnect v.26.02 folder.

Target File Size
DOMPloy — Windows deployment tool DOMPloy_Setup_6.4.1.2089.exe 97 MB
DOMController (ARM) DOMConnect_26.02.02.2594_arm.enc + .sig 173 MB
DOMController Premium (VM / x86) DOMConnect_26.02.02.2594_x86.enc + .sig 176 MB
DOM Service — Windows installer DomServiceWinInstaller.exe 115 MB
DOM Online Gateway — mesh firmware 1.9.2 DOMOnlineGateway_FW_1.9.2.ipk + .sig.bin 2.3 MB
DOM Online Repeater — mesh firmware 1.9.2 DOMOnlineRepeater_FW_1.9.2.enc.bin 575 KB

Start with DOMPloy: install it on a Windows machine, then use it to push the .enc package matching your controller. The .enc/.sig pair is not meant to be installed manually.