GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

Summary: GoAhead, an embedded web server that EmbedThis says runs in hundreds of millions of devices, loaded a certificate revocation list into its default TLS backend but never enabled revocation checking, so a revoked client certificate could still complete the handshake and log in on builds using the OpenSSL backend with mutual-TLS. FoxIO's Sébastien Féry, who reported the flaw, demonstrated a revoked certificate being accepted against GoAhead 6.1.0 with OpenSSL 3.6.2 and issuer checking on; GoAhead 6.1.1, released to device makers on August 2, 2026 and published October 12, fixes it along with 11 advisories in all, three rated critical.
What you should know: The fix only reaches a device when its manufacturer rebuilds and ships firmware, and as of October 27 it was not known whether any manufacturer had done so, while EmbedThis lists HP, Oracle, Siemens, Canon, Rockwell, D-Link and Comcast among GoAhead users. A revoked certificate is what you rely on after a device is stolen or retired, and on an affected build it still opens the door.

Read the original at The Hacker News ↗

Topics: OT / ICS & Critical Infrastructure
Mentions: CVE-2026-115881
Related: ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More Cyber Risks ·
Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026
How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026