Affected Systems

GoAhead embedded web server versions 3.4.5 through 6.1.0 using OpenSSL backend with mutual-TLS and certificate revocation lists configured. Hundreds of millions of devices potentially affected (routers, printers, gateways, industrial controllers from HP, Oracle, Siemens, Canon, Rockwell, D-Link, Comcast). Additional flaws affect LibreSSL legacy verifier (6.1.0 and earlier on LibreSSL 3.2.x, 3.3.2–3.3.6) and Mbed TLS backend (4.0.2 through 6.1.0).

Exploitation Status

No active exploitation reported as of October 27, 2026. Proof-of-concept code published by FoxIO. CVE-2026-115881 (CVSS 9.1) not yet live in public databases. Coordinated disclosure on October 12, 2026 suggests no known attacks during embargo period.

Business Impact

Organizations using GoAhead-based devices with mutual-TLS authentication face authentication bypass risk. Revoked client certificates (e.g., stolen or decommissioned devices) are silently accepted, granting unauthorized access. Exploitation requires specific configuration: OpenSSL backend, client certificate authentication enabled, issuer checking on, and CRL configured. Device owners cannot determine vulnerability from outside; fix requires firmware updates from manufacturers. No manufacturer firmware updates confirmed as of October 27. Additional critical flaw (login bypass with Blowfish passwords in 6.1.0) and Mbed TLS session decryption issue (CVSS 5.9) also present.

Urgency

🟡 Within a week

Recommended Actions

  • Inventory all devices using GoAhead embedded web server (routers, printers, gateways, industrial controllers) and identify those with mutual-TLS configurations enabled
  • Contact device manufacturers (HP, Oracle, Siemens, Canon, Rockwell, D-Link, Comcast, others) to request firmware updates containing GoAhead 6.1.1 or later
  • Use FoxIO JA4Scan tool to fingerprint GoAhead servers by TLS backend and identify potentially vulnerable builds on your network
  • For OpenSSL backend builds with mTLS: monitor authentication logs for suspicious client certificate usage until patched; consider temporarily disabling client certificate authentication if operationally feasible
  • For Mbed TLS backend builds: disable finite-field DHE cipher suites or switch to OpenSSL backend to mitigate session decryption risk until firmware update available
  • If running GoAhead 6.1.0 specifically: prioritize patching due to critical login bypass flaw affecting HTTP Basic and form authentication with Blowfish password format