GoAhead o'rnatilgan veb-serveri sertifikat bekor qilish ro'yxatini o'zining standart TLS orqa qismiga yukladi, lekin bekor qilish tekshiruvini hech qachon yoqmadi, shuning uchun bekor qilingan mijoz sertifikati ta'sirlangan sozlamalarda hali ham kirishdan o'tishi mumkin edi.
Kamchilik OpenSSL orqa qismi bilan o'zaro TLS ishlatiladigan qurilmalarda, ya'ni server mijoz sertifikatini tekshiradigan va aksincha, va bekor qilingan sertifikatlarni bloklash uchun bekor qilish ro'yxati sozlangan qurilmalarda uchraydi.
Bu operator ataylab yoqadigan sozlama; standart qurilma bunday emas. GoAhead 6.1.1, qurilma ishlab chiqaruvchilarga 2026-yil 2-avgustda chiqarilgan va 12-oktabrda ommaga e'lon qilingan, bu muammoni tuzatadi.
GoAhead — bu qurilma ishlab chiqaruvchilar routerlar, printerlar, shlyuzlar va sanoat nazoratchilarida boshqaruv sahifalarini ishlatish uchun proshivkaga o'rnatadigan kichik veb-server. Uning ishlab chiqaruvchisi EmbedThis aytishicha, u yuzlab million qurilmalarda ishlaydi.
Kamchilikni FoxIO'dan Sébastien Féry topdi, u 26-oktabrda yozgan maqolasida bu va yana ikkita TLS muammosini tasvirladi.
Ta'sirlangan qurilmada server bekor qilish ro'yxati faylini ishga tushirishda yuklaydi va xato haqida xabar bermaydi, shuning uchun uni sozlagan operator bekor qilish ishlayapti deb o'ylashga to'liq asosga ega. Aslida u ishlamaydi. Sertifikati bekor qilingan mijoz, masalan o'g'irlangan yoki ishdan chiqarilgan qurilma, sertifikat hali ham yaroqli bo'lgandek qo'l siqishdan o'tadi va shu shaxsiyatga berilgan har qanday kirish huquqini oladi.
FoxIO'ning GoAhead 6.1.0 va OpenSSL 3.6.2 ga qarshi sinovida bekor qilingan sertifikat chiqaruvchi tekshiruvi yoqilgan holda qabul qilindi.
OpenSSL maslahatida bekor qilingan mijoz sertifikatlari jimgina qabul qilinishi aytilgan. Foydalanish uchun qurilma mijoz sertifikatlari talab qilinadigan, ishonchli sertifikat markazi to'plami va chiqaruvchi tekshiruvi yoqilgan, hamda bekor qilish ro'yxati sozlangan OpenSSL orqa qismini ishlatishi kerak; hujumchi ishonchli markaz tomonidan imzolangan va bekor qilingan deb ro'yxatga olingan sertifikatga ega bo'lishi kerak. Mbed TLS orqa qismini ishlatadigan qurilmalar ta'sirlanmagan; bu orqa qism bekor qilishni alohida kod yo'li orqali tekshiradi.
Maslahatdagi identifikator CVE-2026-115881, EmbedThis tomonidan 9.1 deb baholangan. 27-oktabr holatiga ko'ra, bu identifikator va quyidagilar hali ommaviy CVE va NVD ma'lumotlar bazalarida faol emas edi; EmbedThis ularni so'raganini aytadi. Jiddiylik baholari sotuvchining o'z baholari.
Tadqiqotchilar yana ikkita muammoni qamrab oladi, har biri ma'lum TLS qurilmasiga bog'liq. Versiyalar va tuzatishlar farq qiladi, shuning uchun quyidagi jadval har birini orqa qism bo'yicha ko'rsatadi.
| TLS qurilmasi | Nima noto'g'ri | Ta'sirlangan versiyalar | Tuzatish yoki vaqtinchalik variant |
|---|---|---|---|
| OpenSSL (standart) | Bekor qilish ro'yxati yuklanadi, lekin hech qachon majburlanmaydi; bekor qilingan mijoz sertifikatlari qabul qilinadi. CVE-2026-115881, 9.1 baholangan. | 3.4.5 dan 6.1.0 gacha | 6.1.1 ga yangilash. Maslahatda vaqtinchalik variant yo'q. |
| LibreSSL eski tekshiruvchi (3.2.x, 3.3.2–3.3.6) | Mijoz sertifikatlari talab qilinganda, lekin chiqaruvchi tekshiruvi o'chirilganda, chegaradan uzunroq mijoz sertifikat zanjiri qabul qilinadi. CVE-2026-115884, 7.4 baholangan. | Shu LibreSSL versiyalarida 6.1.0 va undan oldingi | 6.1.1 ga yangilash, yoki ishonchli CA to'plami bilan chiqaruvchi tekshiruvini yoqish, yoki OpenSSL yoki LibreSSL 4.x ishlatish. |
| Mbed TLS | Uzunlik xatosi 2048-bitli to'liq qiymat o'rniga 1-baytli Diffie-Hellman qiymatini yuboradi, shuning uchun passiv kuzatuvchi sessiyani shifrini ochishi mumkin. 5.9 baholangan. CVE tayinlanmagan. | 4.0.2 dan 6.1.0 gacha | 6.1.1 ga yangilash, chekli maydon DHE to'plamlarini o'chirish, yoki OpenSSL orqa qismini ishlatish. |
Mbed TLS muammosi sessiyaga faqat mijoz buzilgan sozlamani qabul qilganda yetadi. OpenSSL, hozirgi Go, hozirgi Java va asosiy brauzerlar shunchalik kichik qiymatni rad etadi va kuchliroq kalit almashinishiga o'tadi, shuning uchun sessiya hech qachon tugamaydi.
Minimal o'lcham tekshiruvi bo'lmagan mijozlar, masalan ba'zi o'rnatilgan yoki maxsus mijozlar, uni qabul qiladi, va keyin trafikni yozib olgan har kim kalitni hisoblab, sessiyani o'qishi mumkin. TLS 1.3 va ECDHE sessiyalari ta'sirlanmagan, va Mbed TLS 4.x ular tayanadigan kalit almashinishini olib tashlagan.
LibreSSL muammosi hujumchiga GoAhead'ning 10-sertifikat chegarasidan uzunroq sertifikat zanjirini taqdim etish va hali ham ishonchli kalitsiz autentifikatsiyalangan mijoz sifatida qo'l siqishni tugatish imkonini beradi.
Bu faqat yuqorida sanab o'tilgan eski LibreSSL versiyalariga bog'langan qurilmalarda va faqat mijoz sertifikatlari talab qilingan, lekin chiqaruvchi tekshiruvi o'chirilgan holatda paydo bo'ladi. OpenSSL, BoringSSL, AWS-LC va LibreSSL 4.x ortiqcha uzun zanjirni rad etadi.
Qurilma qaysi orqa qism va sozlamalarni ishlatishi proshivka kompilyatsiya qilinganda tanlanadi, shuning uchun qurilma egasi tashqaridan qaysi biri amal qilishini aniqlay olmaydi. Bu ham tuzatish sekin kelishining sababi: GoAhead 6.1.1 — bu qurilma ishlab chiqaruvchilar qayta qurib, proshivka yangilanishi sifatida jo'natadigan to'g'ridan-to'g'ri almashtirish, va egasi uni faqat o'z ishlab chiqaruvchisi jo'natganda oladi. Hech bir ishlab chiqaruvchi uni jo'natganmi yoki yo'qmi, ma'lum emas.
27-oktabr holatiga ko'ra, hech bir manba bu muammolarning hujumlarda ishlatilganini xabar qilmagan. EmbedThis siyosati — agar kamchilik foydalanilayotgan bo'lsa yoki boshqa kimdir tomonidan oshkor qilingan bo'lsa, oshkor qilish embargosini tugatish va erta nashr etish, shuning uchun 12-oktabrdagi muvofiqlashtirilgan chiqarilish ma'lum hujumlar yo'qligi bilan mos keladi.
Biroq, bu ularning yo'qligini isbotlamaydi. EmbedThis xavfsizlik yangilanishlari haqida mijozlarga Builder portal orqali xabar beradi. FoxIO isbot-kodini nashr etgan va GoAhead serverlarini orqa qism bo'yicha aniqlash uchun JA4Scan vositasi orqali barmoq izlarini taklif qiladi. Vosita bepul, lekin uning manbai faqat so'rov bo'yicha mavjud, va barmoq izi qurilmani aniqlaydi, tasdiqlangan zaif serverni emas.
EmbedThis GoAhead foydalanuvchilari sifatida sanab o'tgan qurilma ishlab chiqaruvchilarning hech biri — jumladan HP, Oracle, Siemens, Canon, Rockwell, D-Link va Comcast — ta'sirlangan orqa qism va sozlamani ishlatishi ko'rsatilmagan. Ta'sirlangan aholi aniqlanmagan.
Xuddi shu 6.1.1 chiqarilishi jami 11 ta maslahatni yopadi, ulardan uchtasi jiddiy deb baholangan. Biri — kirishdan o'tish: HTTP Basic yoki form kirishdan foydalanadigan qurilmada, hujumchi yaroqli foydalanuvchi nomini bilsa, o'sha foydalanuvchining saqlangan paroli yangi Blowfish formatida bo'lsa, har qanday parol bilan kirishi mumkin, bu formatni GoAhead 6.1.0 versiyasida qo'shgan. EmbedThis form kirish o'zining o'rnatilgan boshqaruv sahifalari uchun standart ekanligini aytadi.
Yangilashdan so'ng, EmbedThis faol sessiyalarni tugatish, serverni qayta ishga tushirish va Blowfish formatida saqlangan parollarni o'zgartirishni tavsiya qiladi.
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups.
The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked certificates.
That is a setup an operator turns on deliberately; a default build does not. GoAhead 6.1.1, released to device makers on August 2, 2026, and publicly published on October 12, fixes it.
GoAhead is a small web server that device makers build into firmware to run management pages on routers, printers, gateways and industrial controllers. Its maker, EmbedThis, says it runs in hundreds of millions of devices.
The flaw was found by Sébastien Féry of FoxIO, who described it and two other TLS problems in a write-up on October 26.
On an affected build, the server loads the revocation list file at startup and reports no error, so an operator who configured it has every reason to think revocation is working. It is not. A client whose certificate was revoked, for example a stolen or retired device, completes the handshake as if the certificate were still valid and gets whatever access that identity allows.
In FoxIO's test against GoAhead 6.1.0 with OpenSSL 3.6.2, a revoked certificate was accepted with issuer checking switched on.
The OpenSSL advisory describes revoked client certificates as silently accepted. To be exploited, the build must use the OpenSSL backend with client certificates required, a trusted certificate authority bundle and issuer checking enabled, and a revocation list configured; the attacker must hold a certificate signed by a trusted authority and listed as revoked. Builds that use the Mbed TLS backend are unaffected; that backend checks revocation via a separate code path.
The identifier on the advisory is CVE-2026-115881, rated 9.1 by EmbedThis. As of October 27, that identifier and the others below were not yet live in the public CVE and NVD databases; EmbedThis says it has requested them. The severity ratings are the vendor's own.
Researchers cover two further problems, each tied to a specific TLS build. The versions and fixes differ, so the table below maps each by backend.
| TLS build | What goes wrong | Affected versions | Fix or interim option |
|---|---|---|---|
| OpenSSL (default) | Revocation list loaded but never enforced; revoked client certificates accepted. CVE-2026-115881, rated 9.1. | 3.4.5 through 6.1.0 | Upgrade to 6.1.1. No interim option in the advisory. |
| LibreSSL legacy verifier (3.2.x, 3.3.2–3.3.6) | A client certificate chain longer than the limit is accepted when client certificates are required but issuer checking is off. CVE-2026-115884, rated 7.4. | 6.1.0 and earlier on those LibreSSL versions | Upgrade to 6.1.1, or turn issuer checking on with a trusted CA bundle, or use OpenSSL or LibreSSL 4.x. |
| Mbed TLS | A length typo sends a 1-byte Diffie-Hellman value instead of the full 2048-bit one, so a passive observer can decrypt the session. Rated 5.9. No CVE assigned. | 4.0.2 through 6.1.0 | Upgrade to 6.1.1, turn off finite-field DHE suites, or use the OpenSSL backend. |
The Mbed TLS problem only reaches a session if the client accepts the broken setup. OpenSSL, current Go, current Java, and mainstream browsers refuse a value that small and fall back to a stronger key exchange, so the session never completes.
Clients without a minimum-size check, such as some embedded or custom ones, accept it, and then anyone who recorded the traffic can work out the key and read the session. TLS 1.3 and ECDHE sessions are unaffected, and Mbed TLS 4.x removed the key exchange they rely on.
The LibreSSL problem allows an attacker to present a certificate chain longer than GoAhead's 10-certificate limit and still complete the handshake as an authenticated client, without any trusted key.
It appears only on builds linked against the older LibreSSL versions listed above and only where client certificates are required with issuer checking off. OpenSSL, BoringSSL, AWS-LC and LibreSSL 4.x reject the over-long chain.
Which backend and settings a build uses are chosen when the firmware is compiled, so a device owner cannot tell from the outside which apply. That is also why the fix is slow to arrive: GoAhead 6.1.1 is a drop-in replacement that device makers rebuild and ship as a firmware update, and an owner gets it only when their manufacturer does so. Whether any manufacturer has shipped it is not known.
As of October 27, no source reported any of these problems being used in attacks. EmbedThis's policy is to end a disclosure embargo and publish early if a flaw is being exploited or disclosed by someone else, so the coordinated October 12 release is consistent with no known attacks.
However, it does not prove there are none. EmbedThis notifies customers of security updates through its Builder portal. FoxIO has published proof-of-concept code and offers fingerprints through its JA4Scan tool to find GoAhead servers by backend. The tool is free, but its source is available only on request, and a fingerprint identifies a build, not a confirmed-vulnerable server.
None of the device makers EmbedThis lists as GoAhead users, which include HP, Oracle, Siemens, Canon, Rockwell, D-Link and Comcast, has been shown to run an affected backend and setting. The affected population is not established.
The same 6.1.1 release closes 11 advisories in all, three of them rated critical. One is a login bypass: on a build using HTTP Basic or form login, an attacker who knows a valid username can sign in with any password if that user's stored password is in the newer Blowfish format, which GoAhead added in version 6.1.0. EmbedThis says form login is the default for its built-in administration pages.
After upgrading, EmbedThis recommends ending active sessions, restarting the server, and changing Blowfish-stored passwords.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.