Station Compliance›Equipment›Sage ENDEC

About the default password

This page does not print the factory credential for the 3644. We have not verified it against manufacturer documentation, and a remembered default is exactly the kind of number that is right on most units and wrong on yours. Take it from the manual for your unit.

What is verified is more useful anyway: on Rev 96 or later, the ENDEC itself will prompt you to change any account still on a default password. Sage's own guidance is that if your ENDEC is reachable from the public internet you need a firewall, and you need non-default passwords — and that the ENDEC will warn you about the second.

Two things follow from that:

• If the unit is below Rev 96, nothing on it will warn you. A 3644 commissioned years ago by someone else may still be on whatever it shipped with.
• Rev 96 supports more than one account. Changing the password you log in with does not change the others. Look at every account on the unit, not just your own.

Why Rev 96 matters for more than this rule

Rev 96 was separately required by March 11, 2024 for CAP prioritization and national message text handling, and it included replacement security certificates. A 3644 not yet on Rev 96 or later is behind on more than 47 CFR § 11.35(d), which is why "Sage 3644 below Rev 96" has its own line in the order we suggest working through a rack.

Sage has ended manufacturing of the 3644

That changes how you plan, not whether the unit is in scope. Record the firmware revision you are on and the date you confirmed support status, so the decision you made is on paper. The kit's compliance guide covers how to handle end-of-support equipment in your records.

Do this today

1. Find the firmware revision. If it is below Rev 96, that is the first job — for this rule and for the 2024 requirement it was already due under.
2. Turn off HTTP in favor of HTTPS. Rev 96 makes it possible; it does not make it automatic.
3. Clear every default-password prompt the unit raises, for every account, and remove accounts that belong to nobody who still works with you.
4. Confirm the ENDEC is not reachable from the public internet. Check your router for port-forwarding rules and DMZ assignments pointing at it. Then check from outside — a phone on cellular data, not station Wi-Fi.

Then verify the password length yourself

We do not publish maximum password lengths where the manufacturer does not document them, because a guessed number would cause you to record compliance you do not have. The length your specific firmware revision accepts is something to determine on your own unit, in two minutes:

1. Set a 16-character random password.
2. Confirm it saves without error.
3. Log out, and log back in with the full 16 characters.
4. Then try logging in with only the first 8. If that works, the device is silently truncating your password — a failure that looks exactly like success.

If the unit cannot hold 15 characters, the FCC's FAQ leaves three routes: an alternative authentication measure on the unit itself that is at least as secure as a strong password, a replacement unit, or a waiver from the Commission. Keeping it off the public internet is still essential, but it satisfies the separate segmentation requirement, not this one: the FAQ says a firewall or VPN in front of the device is not enough. An EAS box is in scope however it is managed, so turning off its web interface does not take it out of the rule either. Record which route you took in your own file.

Don't stop at the web password

Most networked broadcast gear offers more than one way in — web, Telnet, SSH, SNMP, a vendor application, a serial console, sometimes a front panel. These frequently keep separate credential stores. We have not verified which management paths on the 3644 share a credential and which do not, so do not assume: setting a strong web password on a unit whose other paths still accept the factory login changes nothing except your paperwork, which now says you fixed it.

List every management path your unit offers — the manual is the place to start — then verify each one separately: log in through it, confirm the new credential works, and confirm the old one does not.