GoAhead 6.1.1 fixes 11 security advisories, including CVE-2026-115881, a critical OpenSSL mutual-TLS revocation bypass where certificate revocation lists were loaded but never checked.
The release also addresses a LibreSSL verifier issue and a DH key length flaw.
The issues were discovered by researcher Sébastien Féry from FoxIO and concern the ways in which manufacturers configure software when building devices. EmbedThis has released version 6.1.1, which fixes a total of eleven issues.
How connections and certificates are affected
The main problem concerns the way the system handles digital identity certificates. Although a list of revoked certificates could be defined to prevent login, the system loaded the list but did not actually activate it. Thus, a device or user with a revoked certificate could still log in.
In another case, the system accepted a certificate chain longer than the allowed limit when issuer checking was disabled. In addition, an issue was identified where the encryption key exchange was too small, which allowed someone monitoring network traffic to decrypt the connection.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
CISA confirms attacks on millions of websites via PHP vulnerabilities
↗
Additionally, the update fixes three critical issues, including a login bypass issue related to how passwords are stored.
What should manufacturers do?
The issues depend on the settings each manufacturer has chosen for their device. The company recommends that manufacturers integrate the new update, terminate active connections, restart the server, and change stored passwords. As of late October 2026, there were no reports of these issues being used in real-world attacks.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Add us to your preferred sources for more updates from Hacks.gr.
Preferred source
↗
end of article
Top comments (0)