TOA has identified multiple vulnerabilities within certain IP-A1 Series devices, including vulnerabilities associated with PHP and other authentication-related functions. Under specific conditions, these vulnerabilities could potentially allow an unauthorized third party to execute commands remotely, gain unauthorized access, or perform unintended operations on affected devices.

Importantly, TOA reports that there have been no known cases of these vulnerabilities being exploited against affected products at the time of publication.

To maintain the highest level of security, TOA strongly recommends updating affected devices to the latest firmware version.

Affected Products

The advisory applies to the following IP-A1 Series products running firmware version 3.6.1 or earlier:

• IP-A1AF IP Audio Interface
• IP-A1PA12 IP Power Amplifier
• IP-A1PC238 IP Ceiling Speaker
• IP-A1PG IP Paging Gateway
• IP-A1RMY IP Remote Microphone
• IP-A1SC15 IP Horn Speaker
• IP-A1PC580R IP Ceiling Mount Speaker
• IP-A1PC580S IP Square Speaker

Recommended Action

A corrective firmware release is now available for all affected products. Customers should update their devices to firmware version 3.6.2 or later as soon as practical.

Firmware and setup documentation can be downloaded from the TOA Products Data Download Site. Following the update instructions provided in the applicable device setup manual will ensure a smooth upgrade process. https://www.toa-products.com/international/ 

Note: Once upgraded to the corrected firmware version, devices cannot be downgraded to earlier firmware releases.

Best Practices While Planning an Update

For customers who cannot immediately deploy the updated firmware, TOA recommends implementing the following security measures to reduce risk:

Avoid exposing IP-A1 devices directly to the public Internet.
Restrict network access using firewalls, routers, or access control policies. Use HTTPS communication whenever available.
Limit device access to authorized personnel and trusted network segments.

While these measures can help reduce exposure, they should be considered temporary safeguards until the firmware update can be completed. For more information please reach out to [email protected]