GoKawiilGoAhead embedded web server patches three TLS vulnerabilities
Security researchers disclosed three separate TLS flaws in GoAhead, an embedded web server used for device management in hundreds of millions of IoT, OT, firewall and military devices from vendors including Palo Alto Networks, D-Link, Siemens and Lockheed Martin. The bugs affect GoAhead's OpenSSL-compatible, LibreSSL and Mbed TLS backends, allowing revoked client certificates to be accepted, encrypted sessions to potentially be decrypted, or certificate chain-depth limits to be bypassed depending on configuration. GoAhead version 6.1.1 fixes all three issues, with additional mitigations available for affected deployments.