Critical GoAhead Web Server Flaw Allows Attackers to Bypass Client Certificate Authentication

A critical flaw in the GoAhead embedded web server lets revoked client certificates pass authentication checks, potentially restoring access to identities administrators have blocked.

GoAhead Web Server Flaw GoAhead provides web management interfaces for routers, printers, gateways, and industrial equipment.

GBHackers previously covered GoAhead server vulnerabilities affecting IoT devices, highlighting the wider importance of embedded web server security.

An attacker still needs a previously trusted, revoked client certificate and its matching private key.

Temporary options include disabling finite-field DHE suites for Mbed TLS builds and enabling issuer verification with a trusted CA bundle for affected LibreSSL builds.