TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
Cybersecurity firm FoxIO has disclosed three vulnerabilities in GoAhead’s handling of TLS. They could keep revoked client certificates working, let eavesdroppers decrypt some traffic, or help attackers get around a cap on certificate chain length.
GoAhead, a lightweight web server made by EmbedThis, runs the management interfaces of networking equipment, printers and industrial systems. According to FoxIO, it is present on hundreds of millions of devices across the IoT, OT, firewall and military sectors.
FoxIO’s Sébastien Féry, who documented the flaws this week, said each one affects only a subset of deployments. Which GoAhead devices are at risk depends on the TLS library the manufacturer built into the firmware and how it configured certificate checks.
The critical flaw, CVE-2026-115881 (CVSS score of 9.1), impacts GoAhead 3.4.5 through 6.1.0 when built with OpenSSL or a compatible library and configured for mutual TLS (mTLS) with a certificate revocation list (CRL). The...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
