The EloView 4 and Elo Radar cloud platforms are fundamentally immune to PHP-based security threats. Rigorous, independent security audits have verified that neither product utilizes or contains any PHP code, libraries, or runtimes. No action is required by administrators to secure their environments.
Overview
As enterprise IT teams continuously audit cloud-based management systems for security vulnerabilities related to common server side scripting languages like PHP, Elo provides this architecture-level verification. Our next-generation device management and health-monitoring ecosystems are designed without reliance on legacy web interpreter architectures, neutralizing PHP-based attack vectors at the code level.
Architecture-Level Proof: Why Our Services Are Safe
To verify our security posture, our engineering and security compliance teams performed a comprehensive, independent code and asset reconciliation. The findings confirm absolute protection based on the following architectural safeguards:
1. Absolute Zero-PHP Footprint
- No PHP Code or Libraries: Neither EloView 4 nor Elo Radar contain any PHP code, dependencies, or framework libraries within their codebases.
- Serverless Node.js 24 Execution: Both applications run entirely as serverless microservices powered by Node.js 24 on Amazon Web Services (AWS) behind highly secure static websites. Because the runtime environment runs on modern Node.js, there is no PHP interpreter engine present to parse or execute malicious scripts.
2. Hardened Infrastructure & Zero Internet Exposure
- Isolated Supporting Instances: While EloView 4 utilizes backend EC2 instances for utility functions (such as database migrations, build/test runners, and secure remote-access relays), none of these instances are exposed to or reachable from the open internet.
- No Local Servers on Radar: The Elo Radar platform is built entirely serverless and maintains zero active EC2 server instances, reducing the target surface area to absolute zero.
- Secure IoT Telemetry (MQTT over TLS): Device communication and live telemetry route securely over Port 8883 (TCP) using encrypted MQTT over TLS protocols rather than standard HTTP web workers.
3. Client-Side Device Immunity
All physical Android endpoints managed by our cloud networks are inherently protected from web interpreter threats:
- Managed hardware fleets run a hardened, custom Android OS. These devices do not run local PHP web servers and do not parse web interpreter scripts.
- Critical OS updates, remote patches, and firmware-level protections are silently deployed over-the-air via Elo's dedicated, secure OS 360 program.
Recommended Best Practices for Administrators
While Elo's cloud management networks are fully insulated from these threats, we recommend the following administrative security hygiene:
Decommission Legacy EloView 3 Deployments: Legacy EloView 3 portals have officially reached End-of-Life (EOL) and do not utilize the Node.js serverless architecture of EloView 4. Administrators must transition all active devices to EloView 4 to ensure they are protected by our next-generation cloud security.
- Enforce Multi-Factor Authentication (MFA): Mandate MFA across your entire EloView Organization (
OrgID) to block unauthorized portal access. - Utilize Dynamic Domain Whitelisting: Update your corporate Local Area Network (LAN) firewall configurations to permit outbound connections to EloView 4's secure, dynamic endpoints (such as
*.eloview.com) rather than using static IP lists.
Document Information
Target Audience: Enterprise IT, Network Administrators, Security Compliance Officers
Supported Platforms: EloView 4, Elo Radar (SaaS)
Hardware Compatibility: All Elo Android-powered devices managed via EloView
Please report any broken links by emailing elo.support@zebra.com and include a link to the knowledge article