Critical GoAhead TLS flaws put millions of embedded devices at risk
Three newly disclosed vulnerabilities in the GoAhead embedded web server weaken how some devices validate certificates and protect encrypted sessions. Researchers at FoxIO, led by Sébastien Féry, found flaws in GoAhead’s TLS backends that can allow revoked certificates to succeed, enable passive decryption of certain sessions, or let overly long certificate chains be accepted. The issues affect devices that embed GoAhead—found in routers, printers, gateways and industrial controllers from vendors…