From the looks of the DSA, the attack vector is the end user’s browser.  My question if you disable http/https and just use SSH to manage the DD, can that act as a technical workaround, until the DD can be upgraded?