Avalon Nano 3 / 3S Firmware Versions, Downloads & Security History

A plain-language reference for firmware on the Canaan Avalon home line — the Avalon Nano 3 and Nano 3S (and their K230 siblings, the Mini 3 and Avalon Q). It answers three questions: which firmware builds exist, where the official firmware comes from, and why keeping firmware current matters. For the actual step-by-step update procedure, see the Avalon firmware update guide.

Scope: the Canaan Avalon home line built on the Kendryte K230 SoC — Avalon Nano 3 (4 TH/s) and Avalon Nano 3S (6 TH/s), with the Mini 3 and Avalon Q sharing the same K230 update mechanics. This is a reference page: it lists firmware builds, where the official firmware lives, and why staying current matters. It is not a flashing tutorial — for step-by-step update procedures see the Avalon firmware update guide.

Firmware version ladder (Nano 3 / Nano 3S)

Canaan uses a <YYYYMMDDhh>_<git-sha> build string. Known public builds, oldest first. Every row carries the evidence rating for that build’s identity and summary. The newest build is a moving target — always take the current one for your exact sub-model from Canaan’s portal (below).

Build	Date	Applies to	What it is	Evidence
`24071801_42c628d`	Jul 18, 2024	Nano 3	First public Nano 3 firmware. It shipped a command-injection defect in the timezone configuration CGI — the same defect the community jailbreak (orca.pet) later used to obtain a root shell. Superseded; do not run it. orca.pet jailbreak writeup names the vulnerable build heater_nano3_all_2024071801_...swu; Bible NANO_3S_FIRMWARE_RE.md §1.1 [C].	Verified
`build dated ~Aug 6, 2024`	Aug 2024	Nano 3	First patched build reported by owners after Canaan's July 2024 security advisory. Exact version string not published in a primary source we can cite. Bitcointalk owner reports (single secondary); Bible NANO_3S_HARDWARE.md §5 [L].	Inferred
`2025012122_b377540`	Jan 2025	Nano 3S (open build tree)	The build-artifact version carried in Canaan's own public Avalon_Nano3s repository. Building the open network-service layer emits Avalon_Nano3s_2025012122_b377540.kdimg.gz (NAND image) and the matching USB .aup.img.gz. Read directly in github.com/Canaan-Creative/Avalon_Nano3s readme.md (output/ artifact names).	Verified
`25061101_97e23a6`	Jun 2025	Nano 3S	Observed running on a live Nano 3S during Home-Assistant integration testing. A community observation of a shipped build, not a vendor-published changelog. jinx-22/avalon_nano3s HA integration testing; Bible NANO_3S_HARDWARE.md §5 [C].	Supported
`25103101`	Oct 31, 2025	Nano 3 / 3S	The build to be on, or newer. It closes the timezone-CGI command-injection AND a stability defect that crashed the device roughly every 24 days. SWU filename heater_nano3_all_2025103101_151231.swu. orca.pet states 25103101 "closes the timezone bug" and "an annoying bug that made the device crash every 24 days"; Bible NANO_3S_FIRMWARE_RE.md §1.1 [C].	Verified
`26040201_b73be50 (image 2026040201_13503fb)`	~Apr 2026	Nano 3S	Reported as the current build by a third-party update walkthrough in May 2026 — evidence that the line keeps shipping updates past 25103101. Treat "latest" as a moving target and take the current build for your exact sub-model from Canaan's portal. snotra.uk Nano 3S firmware walkthrough, May 2026 (single third-party guide).	Inferred

6 public builds tracked; 3 confirmed against a primary source. Ratings: Verified = read in a primary source (vendor repo, vendor doc, or the machine itself) · Supported = observed on a shipped unit · Inferred = single secondary report · Unknown = not established.

Where the official firmware lives

Canaan distributes Avalon home firmware through its own support portal. D-Central does not host or mirror Nano 3 / 3S firmware, and we do not publish deep links to individual firmware files — a firmware filename encodes the exact sub-model and control-board generation, and linking one file invites a mismatch.

Source	What it is	Evidence
`https://www.canaan.io/support/file_download`	Canaan’s support-portal download surface. Select your model to reach its software, manuals and firmware. This is the URL Canaan’s own knowledge base names for firmware downloads.	Verified
`https://www.canaan.io/resource/firmwares` → “Avalon Home”	Canaan’s public firmware resource page; pick the Avalon Home product series for the Nano 3 / 3S / Mini 3 / Q. Widely cited by end-user update guides.	Supported

Both Canaan URLs sit behind bot protection, so confirm the live page in a browser before you rely on it. If Canaan reorganises its site, start from canaan.io → Support / Resources and look for the Avalon Home firmware series. When in doubt, contact Canaan support — a firmware build is not something to source from a forum, Telegram group or reseller re-upload.

Match the exact sub-model and control-board generation. A mismatched image is the single most common cause of a failed or bricked flash. The K230 home line (Nano 3, Nano 3S, Mini 3, Avalon Q) and the older industrial AvalonMiner line (A12xx / A13xx / A14xx) use different firmware and different tools — they are not interchangeable. Home-line .swu images are RSA-signed and verified on the device, so an image built for one model is rejected on another; do not try to force it.

Security history — why staying current matters

Two defects in the early Nano 3 firmware are worth knowing about, because both are fixed simply by running a current build. This section is deliberately descriptive: it explains what was wrong and which build fixed it, with no exploitation detail.

1. Timezone configuration command injection (fixed)

The first public Nano 3 firmware (24071801_42c628d) contained a command-injection weakness in the web UI’s timezone configuration handler: a value that should only have named a timezone could be made to run a shell command on the device. Reaching it still required a valid web-UI login, which on an un-customised unit was the factory default — one more reason to change the default password on first setup. This is the same defect the community used to jailbreak early units; we describe that scene factually, without a recipe, in the custom-firmware landscape. Canaan issued a public security notice for the Nano 3 in July 2024 and shipped patched firmware.

2. The ~24-day uptime crash (fixed)

Separately, a stability defect caused the device to crash roughly every 24 days of continuous uptime — the signature of a counter/timer rollover. For a miner that is meant to run unattended, a silent reboot every few weeks is real lost hashrate.

Both are closed by firmware 25103101. If a Nano 3 or Nano 3S is on anything older, update it — from Canaan’s portal, matched to your exact model. Keep firmware current the same way you would on any internet-connected miner: newer builds carry the security and stability fixes.

Looking at an open-source alternative for Canaan hardware? DCENT_OS is building one — it is in active development, with no public image and no install route for Avalon yet. What is proven, and what is next, is documented honestly on the DCENT_OS pages. Nothing on this page is an instruction to replace Canaan’s firmware.

D-Central sells and services Canaan Avalon home hardware from Montréal. Sources: Canaan support knowledge base (firmware download URL); Canaan’s public Avalon_Nano3s repository (build artifact names); orca.pet Nano 3 jailbreak writeup (build strings and the two fixed defects, cited factually); community update guides (Mineshop, Snotra) and Home-Assistant integration testing (running builds). Full working notes in D-Central’s hardware research archive. Cross-reference: ASIC firmware compatibility matrix.

Related products, repair, and setup paths

Last reviewed August 21, 2026.