Critical GoAhead TLS Flaws Could Expose Hundreds of Millions of Devices to Attacks
Critical GoAhead TLS Flaws Could Expose Hundreds of Millions of Devices to Attacks
https://cybersecuritynews.com/goahead-tls-vulnerabilities/
Three new security flaws affect GoAhead, a small web server that device makers build into routers, printers, gateways, and industrial controllers. The software runs in hundreds of millions of devices, including those used by Palo Alto Networks, Siemens, Honeywell, and Boeing. The flaws affect how these devices check digital certificates and protect encrypted traffic.
The flaw lies in GoAhead’s use of TLS libraries. TLS keeps web traffic private. In a mutual TLS setup, both the server and the client present digital certificates before they trust each other.
Researchers at FoxIO, led by Sébastien Féry, found that the flaws can let a revoked certificate pass, let an observer read some encrypted sessions, or let an overly long certificate chain get accepted. The real impact depends on which TLS library a device uses and how it is configured. Each issue was reported privately in April 2026, fixed in GoAhead 6.1.1, and disclosed in security advisories on October 12.
Trust in certificates has been under strain this month. Cyber Security News reported on the eMudhra certificate compromise, where private keys behind eight intermediate certificate authority certificates were exposed. Embedded TLS libraries have also drawn scrutiny, as seen in the wolfSSL vulnerabilities that put many connected devices at risk.
...
GoAhead 6.1.1 fixes all three issues, [but] ...
A GoAhead fix does not reach devices on its own. FoxIO founder and CTO John Althouse warned on X that a patch from GoAhead does not mean a patch exists for each device, since that depends on the manufacturer. Teams should check firmware updates with their device vendors, especially for equipment that supports critical infrastructure.