X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/hmcfgusb/blobdiff_plain/1ee8653afbf410ed34f9dbc18ffe4beaf3c159e4..920d34e08c728c4e56f80fad26bc8f81f044f674:/README.md

diff --git a/README.md b/README.md
index f0ccc78..37744b9 100644
--- a/README.md
+++ b/README.md
@@ -60,6 +60,14 @@ hmland without this switch. It was the hardcoded default in versions
 This incompatibility is needed so connecting software is able to
 differentiate between HM-CFG-LAN and HM-CFG-USB.
 
+**Important security information:**
+Versions before 0.101 do not correctly transmit the AES channel-mask
+to the HM-CFG-USB, which results in signature-requests not being generated
+by the device in most cases. This can lead to processing of unsigned messages
+by the host-software. If you are relying on authenticated messages
+(with e.g. aesCommReq in Fhem) from devices like door-sensors and remotes,
+you should upgrade to at least version 0.101.
+
 [releases-directory]: https://git.zerfleddert.de/hmcfgusb/releases/
 [hmcfgusb-HEAD-xxxxxxx.tar.gz]: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/hmcfgusb/snapshot/HEAD.tar.gz
 [Homegear]: https://www.homegear.eu/
@@ -68,13 +76,15 @@ differentiate between HM-CFG-LAN and HM-CFG-USB.
 
 1.  Compile the hmcfgusb utilities like in the hmland HowTo above
     (steps 1 to 5) and stay in the directory
-2.  Download the new firmware: [hmusbif.03c7.enc][]:
+2.  Download the new firmware: [hmusbif.03c7.enc][] (extracted from the
+    [Firmware update tool][]):
     `wget https://git.zerfleddert.de/hmcfgusb/firmware/hmusbif.03c7.enc`
 3.  Make sure that hmland is not running
 4.  Flash the update to the USB-stick:
     `./flash-hmcfgusb hmusbif.03c7.enc` (You might need to use `sudo` for this)
 
 [hmusbif.03c7.enc]: https://git.zerfleddert.de/hmcfgusb/firmware/hmusbif.03c7.enc
+[Firmware update tool]: http://www.eq-3.de/Downloads/Software/Firmware%20Update%20Tool/HM-CFG-USB-2_FW-UpdateTool-Usersoftware_V1_1_eQ-3_140619.zip
 
 ### Updating HomemMatic devices over the air (OTA) (also for CUL devices): ###