Security Notice — Action Required

In July 2025 the Provisioner service (arch-aws-prov2.archous.tech) was compromised through CVE-2025-30208, an arbitrary-file-read (LFI) vulnerability in our Vite stack. The exposure included data the Provisioner stores for each connected UISP instance — including the credentials this plugin registers with it.

If this plugin has connected your UISP instance to the Provisioner, treat the following as compromised:

• your UISP API token (used by the plugin to reach UCRM & UNMS);
• the plugin's Provisioner auth token and encryption secret.

These remain valid until rotated. The Provisioner itself has since been remediated — the vulnerable functionality has been removed and it now runs a hardened, locked-down configuration. This notice is about rotating the credentials exposed before that fix. All plugin versions are affected.

To remediate — do both, in order:

1. First, update the plugin to v2.5.3 or later. Download it from the version cards below, then update/disable/enable it in UISP → Settings → Plugins. Earlier versions reuse the exposed UISP token; 2.5.3 moves the plugin onto its own dedicated key. The script rotates keys — it does not update the plugin, so this step must come first.
2. Then run the remediation script below on your UISP host, as any sudo-capable user (it self-elevates and performs its file edits as unms internally). It rotates the plugin's keys and your UISP token, restarts UISP, and verifies the old values no longer authenticate. As a safeguard it aborts, changing nothing, if it detects a plugin version below 2.5.3 — so if you run it too early it simply tells you to update first.

# download, REVIEW, then run as any sudo-capable user (it self-elevates):
curl -fsSLO https://arch-aws-prov2.archous.tech/downloads/remediate-provisioner.sh
less remediate-provisioner.sh          # review before running
sudo bash remediate-provisioner.sh

Questions or help: rspaeth@archous.tech