Cybersecurity firm FoxIO has uncovered three security vulnerabilities in how the "GoAhead" web server handles the Transport Layer Security (TLS) protocol. Given that this lightweight server, developed by EmbedThis, is used to manage interfaces for network devices, printers, and industrial systems, the scope of impact is vast; it is present in hundreds of millions of devices across the Internet of Things (IoT), Operational Technology (OT), firewalls, and even military sectors.
Details of the Discovered Vulnerabilities
The vulnerabilities vary in severity and mechanism depending on the software library integrated into the device:
- Certificate Revocation Bypass (CVE-2026-115881): Received a severity rating of 9.1 (CVSS). It affects versions 3.4.5 through 6.1.0 that use the OpenSSL library. The issue lies in the fact that the server reads the Certificate Revocation List (CRL) but does not instruct the library to actually verify it, allowing the use of revoked certificates (such as stolen ones) without detection.
- Encryption Weakening Vulnerability: Affects versions using the Mbed TLS library. This vulnerability weakens the encryption of certain TLS 1.2 connections, which may allow attackers to perform offline decryption of recorded sessions.
- Certificate Chain Length Bypass (CVE-2026-115884): Received a rating of 7.4 (CVSS). It targets versions using LibreSSL and allows attackers to bypass the maximum certificate chain length on servers that accept certificates from any issuer.
What Matters to Users and Companies?
The real danger lies in the "update gap" between the software developer and the device manufacturer. While the server developer (EmbedThis) has released version 6.1.1 to address the OpenSSL and Mbed TLS issues, this does not mean that affected devices are automatically secure. Device manufacturers must integrate this update into their firmware and then push the updates to end users.
FoxIO noted that major companies rely on devices using the GoAhead server, including: Lockheed Martin, Boeing, Siemens, Honeywell, GE, Oracle, HP, Canon, Comcast, and D-Link, without specifying whether their current products use the vulnerable configurations.
Available Protection Measures
FoxIO recommended several technical measures based on the type of library used in the device:
- For Mbed TLS users: DHE cipher suites with limited fields can be disabled, or one can switch to using the OpenSSL library as a backend.
- For LibreSSL users: It is recommended to enable issuer verification using a trusted CA bundle, or upgrade to LibreSSL 4.x or OpenSSL.