KD5FMU Repository Security & Bug Review

Version 1.0 · Date 2026-07-11 · 30 repositories · 54 total findings

Executive Summary

Static review of all public GitHub repositories under KD5FMU (AllStar Link ham radio tools — shell, PHP, Python). Critical issues cluster in announcement-manager (over-broad www-data sudo, unauthenticated PHP APIs), freeloader (unauthenticated upload/delete), DTMF reboot/shutdown scripts, and ASL3_Multi_App_Install (remote HTTP execution). SkywarnPlus AlertScript shell execution and multiple installers downloading over HTTP without verification are additional high-priority concerns.

Portfolio Summary

7
Critical Security
16
High Security
20
Medium Security
1
Low Security
10
Total Bugs
26
Repos w/ Findings

All Repositories

Detailed Saytime-Weather-TimeFormat-ASL3 patch disclosure (pre-patch flaws 0001–0007): Saytime patch series review

Repository Language Findings Crit High Med Low Report
announcement-manager
Compatible with Supermon 6.1 through Supermon 8 and Allmon3 for announcement creation an… 		Shell/PHP 8 2 2 4 0 View report · GitHub
SkywarnPlus
> [!CAUTION] 		Python 4 0 2 2 0 View report · GitHub
freeloader
<img width="1081" height="383" alt="image" src="https://github.com/user-attachments/asset… 		Shell/PHP 4 1 2 1 0 View report · GitHub
ASL3_Multi_App_Install
![MAPI Logo](https://github.com/KD5FMU/ASL3_Multi_App_Install/blob/main/MAIS.png) 		Shell 3 1 2 0 0 View report · GitHub
Supermon-7.4-Backup-Repository
Supermon - Monitor / Manager Supermon@groups.io https://groups.io/g/Supermon 		Shell 3 0 2 1 0 View report · GitHub
APRS-Linux_Under_Development
APRS-Adventures-Not_Tested 		Shell 2 0 1 1 0 View report · GitHub
DTMF-Reboot-and-Shutdown
This is some script files that will allow you to Reboot or Gently Shutdown your ASL3 Node… 		Shell 2 1 1 0 0 View report · GitHub
DTMF-Shutdown-Reboot
![Internet Monitor Logo](https://github.com/KD5FMU/DTMF-Shutdown-Reboot/blob/main/reboot-… 		Shell 2 2 0 0 0 View report · GitHub
Internet-Monitor-ASL3
![Internet Monitor Logo](https://github.com/KD5FMU/Internet-Monitor-ASL3/blob/main/Intern… 		Shell 2 0 1 1 0 View report · GitHub
New-weather.sh-file-Nov-27-2025
This is the latest weather.sh file, Updated by Mike Webb WG5EEK and Paul Aidukas KN2R 		Shell 2 0 0 2 0 View report · GitHub
Play-Audio-ASL3-Node
<p align="center"> 		Shell 2 0 0 2 0 View report · GitHub
Play-Audio-Locally
This is a script file to play audio locally over the AllStar Node 		Shell 2 0 1 1 0 View report · GitHub
Random-Audio-ID
This script file will allow your AllStarLink version 3 node to play an audio file from a … 		Shell 2 0 0 2 0 View report · GitHub
Saytime-Weather-2026
Top of the Hour Spoken Time and Weather Conditions announcement. BETA VERSION 		Shell/Perl 2 0 0 2 0 View report · GitHub
Saytime-Weather-TimeFormat-ASL3
Top-of-the-hour spoken time and current weather conditions for AllStarLink 3 on Debian 12… 		Shell/Perl 2 0 0 2 0 View report · GitHub
Toggle-Duplex-ASL3
This script file will toggle your Half Duplex AllStarLink Node from 1 to 0 		Shell 2 0 0 2 0 View report · GitHub
ASL3-Test-Tone
This installer will install a custom script file to allow you to toggle the built in test… 		Shell 1 0 0 0 1 View report · GitHub
Check-Connection-HamVoIP-Version
This is the Check Connection Script for the HamVoIP Installation 		Shell 1 0 0 0 1 View report · GitHub
Convert-Audio-File-to-ulaw
This script will convert audio file to ulaw files compatible to play on ASL 3 		Shell 1 0 0 0 1 View report · GitHub
Create-Condis
This is a script file to help you create, make executable and place into the /etc/asteris… 		Shell 1 0 1 0 0 View report · GitHub
DVSwitch-4-Me
-DO NOT USE- This is the repo I have to use for now 		None 1 0 0 1 0 View report · GitHub
DVSwitch-Server-for-Raspberry-Pi-Backup-REPO
Backup Repository for DVSwitch Server for AllStarLink 		None 1 0 0 1 0 View report · GitHub
Enable-Disable-CT-s-UNTESTED
These two scripts will Disable and Enable (respectively) the Courtesy Tone's and change t… 		Shell 1 0 0 1 0 View report · GitHub
New-Weather-script-file-for-Supermon-7-4
To install it you first should backup your existing file 		Shell 1 0 0 1 0 View report · GitHub
Staying-Connected
This is a simple AllStarLink Version 3 helper script for Debian 12 that checks to see if … 		Shell 1 0 0 1 0 View report · GitHub
rc.local-replacement
This repository is to replace your rc.local file if needed 		Shell 1 0 1 0 0 View report · GitHub
KD5FMU
![HRC Logo](https://github.com/KD5FMU/KD5FMU/blob/main/New-Github2.png) 		None 0 0 0 0 0 no code · GitHub
MP3-to-ulaw-for-HAMVOIP
Here is a hand script file thata will convert mp3 files to ulaw inside of HamVoIP 		Shell 0 0 0 0 0 View report · GitHub
OpenGD77-Theme-Files
![MAPI Logo](https://github.com/KD5FMU/OpenGD77-Theme-Files/blob/main/OGD77Theme.png) 		None 0 0 0 0 0 no code · GitHub
libre-file
The Libre repo file I need 		None 0 0 0 0 0 no code · GitHub

Top Fix Priorities (Portfolio)

  1. Remove announcement-manager unrestricted www-data sudo; add PHP auth on all endpoints
  2. Remove or restrict freeloader unauthenticated upload/delete
  3. Stop deploying DTMF reboot/shutdown (*992/*993) on publicly accessible nodes
  4. Replace ASL3_Multi_App_Install HTTP remote execution with verified HTTPS packages
  5. Harden SkywarnPlus AlertScript — avoid shell=True and untrusted command strings