Rodecaster Duo owner finds default SSH access, bundled public keys, and unsigned firmware updates in the audio interface

A user investigating a Rodecaster Duo firmware update found the firmware package was a gzipped tarball containing device binaries and update scripts. They also discovered SSH is enabled by default with public-key authentication, and the firmware update process appears to lack signature checks.

The findings highlight how connected hardware can expose unexpected administration paths, even in consumer audio gear. While modifiable firmware may appeal to hobbyists, default network services and unsigned updates raise supply chain and device-security concerns for vendors and users alike.

My audio interface has SSH enabled by default