greendrake avatar image
greendrake asked

Cerbo GX 2.85 remote console over LAN login bug

Just updated my Cerbo GX firmware to 2.85 to (in the hope to see any difference re this MQTT issue) and now the web login fails due to this JavaScript error "genSaltSync is not defined" in bCrypt.js at line 612:


I did disable WiFi access point and Bluetooth, so VictronConnect app is useless (even though it does see the GX on the local network connected by cable). VRM portal has never been configured, and I think I have disabled it in the Settings as well (at least, trying to add the Portal ID to VRM does not work).

What now? Factory reset? Downgrade from USB/memory card?

Thankfully I can use the Venus HTML5 App to see and control what I actually need to control (inverter on/off and charging current), but heck, how to update the GX when they fix the bug?

The JS code can be patched in-place via the dev console. But I haven't yet been able to figure out what the missing `genSaltSync` function should look like. Does anyone know now to approch the developer who coded the file? If I could hack/fix the JS in-place I would just log in and remove the password, and then wait for a proper update/fix. Much better than a factory reset.

cerbo gx
2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

3 Answers
greendrake avatar image
greendrake answered ·

I have compared the Remote Console source code between 2.66 and 2.85.

File `/var/www/venus/index.php`:

In 2.66, the salt for password hashing was derived as

$identifier = @file_get_contents('/data/venus/unique-id');

In 2.85:

// The salt is derived from the unique-id of the Venus device, since the unique-id,
// turned out to be not unique by mistake at times, it was replaced by something with
// was unique. As a consequence the salt changed and hence it is no longer possible
// to authenticate. So pass the salt, instead of the unique-id.
function getSalt() {
    $fh = fopen("/data/conf/vncpassword.txt", "r");
    if (!$fh)
        return "";
    $salt = fread($fh, 29);

    // NOTE: be strict about the format, to prevent accidentally leaking secrets if
    // a different format is used e.g.
    if (!preg_match('/^\$2a\$08\$[A-Za-z0-9+\\.]{22}$/', $salt))
        return "";

    return $salt;

and then:

var salt = '<?= getSalt(); ?>';

The result in my web browser is empty string. Why? Where would the `/data/conf/vncpassword.txt` file come from? Upgrading firmware is not supposed to overwrite the `/data` directory, and I am not sure 2.66 maintained this file.

So, this is just mind-boggling. How is it even supposed to work?


I have now resolved the issue by performing factory reset. The password has gone (like all the other settings I had).

Booooo to the developers who overlooked how old password/salt is to be carried over on firmware upgrades.

2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

mvader (Victron Energy) avatar image
mvader (Victron Energy) answered ·

Dear @Greendrake , we looked into this, and indeed there is a bug. It affects only some units. How many is hard to say; but my estimate for now is that its not too many, since we haven't seen many complaints yet.

For you: factory resetting has removed the password, and that (removing the password) is what made it work again for you. If you'd now put a password on Remote Console, it will stop working again.

For anyone else affected, the issue is that some percentage of GX devices has an issue with Remote Console on LAN, and only in case they have a password set for Remote Console. In case you are affected, I recommend to wait a little a few days, we'll very soon (tomorrow if we're lucky) release a v2.86 that solves this.

Remote Console on VRM is not affected.

Thank you for your report, and sorry it took a while to respond; I noticed it only today.


2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.

jeroen avatar image
jeroen answered ·

Thanks for the Booooo award, should fix it. I am not sure we have a Booooo award medal though.

Seriously, the /data/conf/vncpassword.txt file contains your encrypted password, we don't want to accidentally leak that. We do need the salt though, and unfortunately it contained a forward slash which was not included in the regex.

2 |3000

Up to 8 attachments (including images) can be used with a maximum of 190.8 MiB each and 286.6 MiB total.