Hotspot Security

Updated 16 Oct 2026. How exposed a hotspot really is, what the default passwords are, and the few steps that keep it safe. Pi-Star and WPSD are covered together because they work the same way. The SharkRF openSPOT 4 Pro is very different, so it has its own section further down.

The short answer: behind an ordinary home router, nothing on the internet can start a connection to your hotspot. The real risks are a default password that was never changed, a setup Wi-Fi network left open, and old software. All three are easy to fix.

Pi-Star and WPSD

How a hotspot connects

A hotspot reaches out to the networks. It calls BrandMeister, TGIF or a reflector, and the network answers back on that same connection. Your router keeps track of the call and lets the answer in. Nothing has to be opened or forwarded on the router for normal use.

That is the important part. Because the hotspot makes the call, a stranger on the internet has no door to knock on. Your router turns away anything that was not asked for.

Hotspot on your LAN Your router keeps track Network BM, TGIF, XLX Stranger on the internet calls out answer comes back turned away

Pi-Star also has its own firewall. It blocks everything coming in except replies to calls the hotspot made, plus the dashboard and SSH for devices on your home network. WPSD has a similar firewall.

The exception: if you forward ports on your router, or set the dashboard or SSH to Public on Pi-Star, you open a door from the internet straight to the hotspot. Don't, unless you have a strong password and a good reason.

The default password

Every Pi-Star and WPSD hotspot ships with the same login:

ItemDefault
User namepi-star
Passwordraspberry
What it opensBoth the dashboard admin pages and an SSH login, which gives a command line on the hotspot. One password covers both.
SSHOn by default, on both Pi-Star and WPSD.

Everyone knows that password, so change it before anything else. The password box is on the dashboard's configuration page, and changing it there changes the SSH password too.

Since April 2026, Pi-Star refuses the default password when someone logs in from outside your home network and makes them change it. From inside your home network it shows a red warning instead. WPSD advises changing it but does not force you.

The setup Wi-Fi network

If a hotspot can't join a Wi-Fi network a few minutes after it starts, it turns on its own Wi-Fi network so you can set it up from a phone. On Pi-Star the network is called Pi-Star-Setup, or the hotspot's name if you changed it. On WPSD it is called WPSD-Setup.

By default that network may have no password, so anyone within range could join it and reach the dashboard. If your hotspot travels with you, or your home Wi-Fi drops now and then, set a password for the setup network on the dashboard, and change the login password as above.

Remote access, UPnP and port forwarding

Many people want to check their hotspot while away from home. The safe way is a VPN, such as ZeroTier or Tailscale, which lets your phone or laptop join your home network privately with no ports opened. A member of the Pi-Star team puts it plainly: they do not advise opening the dashboard to the internet.

Pi-Star has a setting called uPNP. When it is on, Pi-Star asks your router to open certain ports by itself. In the current code it asks only for the D-Star ports, unless you set the dashboard or SSH to Public, which adds those too. DMR, YSF, P25, NXDN and M17 never need it. If you don't use D-Star, you can turn uPNP off. Many routers also let you turn UPnP off entirely.

Keep it up to date

A hotspot is a small Linux computer, and like any computer it needs updates. Each Pi-Star line sits on a different Debian Linux release, and the older releases no longer get security fixes:

VersionLinux baseSecurity fixes
Pi-Star 4.1Debian BusterEnded 30 Jun 2024
Pi-Star 4.2Debian BullseyeEnded 31 Aug 2026
Pi-Star 4.3Debian BookwormLong-term support until 30 Jun 2028
WPSDDebian Trixie, or BookwormCurrent

WPSD updates itself overnight, so leave it powered on. Pi-Star refreshes its own programs nightly, but operating system updates need you to run an update from the dashboard or the command line.

Worth knowing: Pi-Star released a set of security fixes on 28 Apr 2026 (versions 4.1.11, 4.2.4 and 4.3.5). Before that, the dashboard ran with full control of the whole system, and a flaw in the password change could be used to run commands. If your hotspot is older than that, update it. An earlier flaw, CVE-2022-45182, was fixed in October 2022.

What a hacker could actually do

If someone did get into a hotspot, they would be on a Linux computer inside your home network. From there they could try to reach your other computers, and they could change the hotspot's settings. That is why the password matters more than anything else on this page. A hotspot with a changed password, nothing set to Public and current software is a very hard target.

Pi-Star and WPSD checklist

  1. Change the pi-star / raspberry password.
  2. Leave the dashboard and SSH on Private. Don't forward ports to the hotspot.
  3. Use a VPN for remote access instead of opening ports.
  4. Turn off uPNP if you don't use D-Star.
  5. Set a password on the setup Wi-Fi network.
  6. Keep the hotspot updated. Pi-Star should be at least 4.1.11, 4.2.4 or 4.3.5, and 4.3 is the line still on a supported Linux release.
  7. Set your BrandMeister and TGIF hotspot passwords. See the networks section below.

SharkRF openSPOT 4 Pro

The openSPOT 4 Pro is a different kind of hotspot. It is not a Raspberry Pi and does not run Linux. SharkRF built it on its own small operating system, so there is no SSH, no command line and no SD card. That removes most of the Pi-Star worries on this page. It brings two of its own, though: out of the box, its web page and its setup Wi-Fi network have no password at all.

How it connects

Like Pi-Star, it calls out to the networks and needs no port forwarding. It does not use UPnP. It connects to your router over 2.4 GHz Wi-Fi only.

The web page has no password

By default, anyone on your home network can open the openSPOT's web page and change its settings, including the network passwords stored in it. Set a password on the Network page, in the Change web int. password box. It is not forced on you, so it is easy to skip.

Note: BrandMeister's help page says the openSPOT default password is "openspot". That was the original openSPOT. SharkRF's openSPOT 4 manual says the 4 has no password until you set one.

Its own Wi-Fi network

The openSPOT 4 makes its own Wi-Fi network, called openSPOT4 AP, when it has no Wi-Fi set up, or when you hold the Wi-Fi button for 3 seconds. By default this network has no Wi-Fi password. Set one in the AP key box on the Network page, and leave Always start in AP mode unticked.

Remote access

The SharkRF Link app finds the openSPOT on your own Wi-Fi network. To use it away from home, SharkRF's instructions have you forward a port on your router to the openSPOT's web page. That page uses plain web traffic with no encryption, so a forwarded port puts it on the open internet. If you want remote access, set the web password first, or use a VPN instead of a forwarded port.

Updates

The openSPOT checks for new firmware by itself and installs it if Automatic upgrade is ticked. There is no operating system for you to patch. SharkRF says nothing about whether its firmware is signed, and we found no known security flaws or advisories for openSPOT devices.

openSPOT checklist

  1. Set a web page password on the Network page.
  2. Set an AP key for the openSPOT4 AP network, and leave Always start in AP mode unticked.
  3. Don't forward a router port to it. Use a VPN for remote access.
  4. Leave Automatic upgrade ticked.
  5. Set your BrandMeister and TGIF hotspot passwords. See below.

Your DMR ID on the networks

This risk has nothing to do with your hotspot's own settings. Someone could set up their own hotspot using your DMR ID and callsign. Both BrandMeister and TGIF give you a personal password to stop that. It works the same on every kind of hotspot.

BrandMeister

BrandMeister reported people using other hams' IDs more and more in 2019. Its fix is the Hotspot Security password, which is now required for hotspots. Set it in BrandMeister SelfCare, then enter the same password in your hotspot's BrandMeister settings. On the openSPOT it goes in the password box of the Homebrew/MMDVM connector.

TGIF

TGIF gives every user a long, personal hotspot password that it makes for you. Log in at tgif.network, click your callsign, then User Security, and copy the password with the blue clipboard icon under your DMR ID. Enter it as the TGIF password in your hotspot's DMR settings, in place of the old shared password passw0rd.

Unlike BrandMeister, TGIF does not require it. The shared password still connects. But some talkgroups, including the TGIF Mothership (TG31665), accept only hotspots using the personal password. Using it also keeps anyone else from connecting to TGIF with your ID.

Sources

  1. Pi-Star code on GitHub, AndyTaylorTweet: Pi-Star_Binaries_sbin (pistar-firewall, pistar-upnp.service, pistar-daily.cron) and Pi-Star_DV_Dash (admin/configure.php, config/banner_warnings.inc)
  2. Pi-Star downloads, changelog and beta pages, pistar.uk (defaults, setup Wi-Fi, Linux bases, April 2026 fixes)
  3. Pi-Star forum, forum.pistar.uk: MW0MWZ on outbound connections, Pi-Star team advice on remote access and UPnP, setup Wi-Fi notes
  4. WPSD manual, manual.wpsd.radio (network configuration, initial startup, install, system manager) and the WPSD Project page, wpsd.w0chp.net
  5. WPSD FAQs, w0chp.radio (automatic updates)
  6. dmrhub.ru: hotspots behind NAT, Pi-Star login and password, WPSD notes
  7. BRARA blog, 31 Dec 2019: DMR Pi-Star users, change your default password
  8. N0DJR, Introduction to the MMDVM Hotspot (qsl.net/n0djr)
  9. Debian news: end of support for Buster (2024), Bullseye (31 Aug 2026) and Bookworm security (12 Jul 2026); linuxiac
  10. CVE-2022-45182: releasealert.dev, PT Security, vulnerabilities.etecs.ru, and Pi-Star_DV_Dash commit 5aa194d
  11. BrandMeister news, 28 Apr 2019, and BrandMeister help: Hotspot Security; YRARC forum, Feb 2020
  12. Kevin Hooke, DZone, Aug 2018; OARC wiki, Pi-Star hotspot (default login)
  13. SharkRF openSPOT4 manual, manuals.sharkrf.com (login, network page, button usage, troubleshooting, Homebrew/MMDVM connector), the openSPOT4 product and changelog pages, and the SharkRF Link app page
  14. SharkRF forum, forum.sharkrf.com: no UPnP and no port forwarding needed; the TGIF security key
  15. dmrhub.ru: openSPOT vs MMDVM hotspots
  16. BrandMeister help: openSPOT (SharkRF) hotspot setup
  17. TGIF help page, tgif.network (secure DMR connection password, User Security, legacy passw0rd)
  18. Miklor, DMR TGIF Security
  19. Pi-Star forum, Sep 2021: TGIF password in the Pi-Star configuration and talkgroups that require it