John Althouse
@4A4133
These vulns were patched in the latest GoAhead 6.1.1, however, IoT and OT devices are rarely updated, leaving hundreds of millions of devices vulnerable. Manufacturers will need to push this update and notify clients.
Embedded
Security incidents tagged Embedded. Newest first.
1 Embedded incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 15
- Longest quiet run: 13 days (Oct 13–Oct 25)
- Patched
GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws
Embedthis GoAhead, the embedded web server behind device-management pages on many IoT, firewall and OT products, fixed eleven advisories in 6.1.1. The critical ones: a Basic and form-auth bypass for users with BF1 (Blowfish) stored hashes where any password works (6.1.0, CVE-2026-115888), OpenSSL builds that load a CRL but never enforce it so revoked mTLS client certificates are still accepted (3.4.5 to 6.1.0, CVE-2026-115881), and Windows CGI command injection through .bat/.cmd scripts run via cmd.exe. Others include mTLS chain-depth bypass on LibreSSL legacy-verifier builds (CVE-2026-115884), httpoxy-style CGI HTTP_PROXY injection (CVE-2026-115882), CGI ISINDEX option injection (CVE-2026-115880), a 1-byte DH modulus on Mbed TLS builds that makes TLS 1.2 DHE_RSA sessions decryptable, request smuggling, and session fixation. The advisories went out Oct 12; FoxIO's Oct 26 write-up on the three TLS bugs drew wide attention. Upgrade to 6.1.1; devices only get the fix when their manufacturer ships new firmware.
Embedthis GoAhead embedded web serverSince Oct 12, 2026
