I just found out I can update the firmware through the Remote Avalon app (https://play.google.com/store/apps/details?id=com.canaan.avalon).

What surprised me is the following: when I add the device based on IP, it just connects to the machine, even though I have put in a password on the web app. I get immediate access to the machine, can update the firmware and change all the details, including miner configuration. How is the app access this, without ever putting in the password?

The behaviour is the same after the firmware upgrade to 24071801_42c628d. I do get a warning in the app that I should change the password, which I did a long time ago, when I got the device. If I want to change the password, I do need the previously set password, but nothing changes. The app just has access to the device, password or not.

Secondly, after a few weeks of uptime, the machines go into a high fan noise sequence with a terrible hashrate, maybe 1/10th of normal operation. The fan can be heard spinning up to full speed for a while and then spinning down again, with way more noise than normally. After a reboot it's fine again, so it doesn't look like an overheating scenario. We're going into winter here, so ambient temp is actually getting lower.