AlphaTheta's PRO DJ LINK advisory is six weeks old, and the only half of it you can act on today is the software.
The 8 August notice covers PRO DJ LINK, the ethernet link that ties CDJs, XDJs and a rekordbox laptop into one network. AlphaTheta's own wording: a third party who gains unauthorized access to that network could view data stored on a connected Windows PC or Mac, or on USB and SD cards inserted into a connected CDJ or XDJ. The company is holding back technical detail until a fix is out, and said in that notice it had not confirmed any cases of damage to date.
Update rekordbox, then check the stick
AlphaTheta's status document lists Ver. 7 and Ver. 6 as partially fixed: use 7.2.17 or later, 6.8.7 or later, and 4.6.28 or later on iOS and Android. The current download is 7.2.18, dated 18 August. "Partially fixed" is AlphaTheta's own phrase, and it sits next to "additional updates planned."
The players are a different story. Every affected unit still reads "Fix in progress": CDJ-3000X, CDJ-3000, CDJ-2000NXS2, CDJ-1500X, CDJ-900NXS, XDJ-1000MK2, XDJ-700, XDJ-AZ and XDJ-XZ. Nothing has shipped for the hardware, and a club's players are not yours to update anyway.
What is yours is the stick. AlphaTheta's precaution is to avoid USB or SD cards holding sensitive data when you use PRO DJ LINK. In practice: a set drive carries music. Not the passport scan, not the contracts, not the folder you dragged off your desktop in 2023. If you connect a player to Wi-Fi, use a secured, password-protected network.
The DJM-A9, DJM-V10, DJM-V5 and DJM-900NXS2 are all listed as not affected, as are the DJS-1000, Stagehand and PRO DJ LINK Bridge. The exposure is the networked players and the media in them, not the mixer.
The feature and the flaw are the same design
We ran Pioneer's launch copy for the CDJ-2000 in September 2009, and it sold Pro DJ Link as an industry first: one USB or SD device "shared simultaneously by up to four players connected via LAN cable." That sharing was the selling point, and seventeen years later it is the thing under advisory.
The CDJ-2000 itself is not on AlphaTheta's status list. The footnote explains what that means: models with PRO DJ LINK functionality that are not listed have reached end of support. Plenty of rooms are still running players older than the list.
