Goahead
Vendor:
First CVE: Mar 31, 2015 · Active for 11 years
20
Total CVEs
More Total CVEs than 94% of tracked products
2.5
Avg CVEs / Year
Higher CVE frequency than 74% of tracked products
8.0
Avg CVSS
Higher Avg CVSS than 70% of tracked products
5.0%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Goahead over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 31, 2015
11 years ago
Most Recent CVE
Oct 17, 2024
645 days ago
CVE Severity & Scoring
Goahead20 CVEs
20%
50%
30%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network19 (95.0%)
Unknown1 (5.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low15 (75.0%)
High4 (20.0%)
Unknown1 (5.0%)
User Interaction
None18 (90.0%)
Unknown1 (5.0%)
Required1 (5.0%)
Privileges Required
Low3 (15.0%)
High0 (0.0%)
None16 (80.0%)
Unknown1 (5.0%)
Top CVEs
Signals from CVEs in this product scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-17562HIGH Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CG | Dec 12, 2017 | 8.1 | 98 | YES | YES |
CVE-2019-5096CRITICAL An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and | Dec 3, 2019 | 9.8 | 68 | NO | NO |
CVE-2021-42342CRITICAL An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. | Oct 14, 2021 | 9.8 | 63 | NO | NO |
CVE-2019-5097HIGH A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A spe | Dec 3, 2019 | 7.5 | 48 | NO | NO |
CVE-2017-5674CRITICAL A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.i | Mar 13, 2017 | 9.8 | 42 | NO | NO |
CVE-2014-9707HIGH EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (dot), which allows remote attackers to conduct directory traversal attacks, cause a | Mar 31, 2015 | 7.5 | 42 | NO | YES |
CVE-2019-16645HIGH An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtained from an arbitrary H | Sep 20, 2019 | 8.6 | 41 | NO | YES |
CVE-2017-1000471CRITICAL EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service. | Jan 3, 2018 | 9.8 | 32 | NO | NO |
CVE-2021-43298CRITICAL The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated net | Jan 25, 2022 | 9.8 | 31 | NO | NO |
CVE-2021-41615CRITICAL websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the se | Aug 8, 2022 | 9.8 | 30 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (20 CVEs).
CISA KEV
1 CVE
5.0% of CVEs· 97th percentile
Metasploit
2 CVEs
10.0% of CVEs· 97th percentile
Nuclei
1 CVE
5.0% of CVEs· 97th percentile
ExploitDB
2 CVEs
10.0% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (20 CVEs).
Media Mentions
Signals from CVEs in this product scope (20 CVEs).
Top CNAs Publishing CVEs For Goahead
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 5.0.1 | 2 | 8.7 | 56.0% | 0 | 0 |
| 4.1.1 | 2 | 8.7 | 56.0% | 0 | 0 |
| 4.0.0 | 1 | 9.8 | 8.6% | 0 | 0 |
| 3.6.5 | 3 | 8.3 | 39.3% | 0 | 0 |
| 3.6.4 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.6.3 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.6.2 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.6.1 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.6.0 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.5.0 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.4.9 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.4.8 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.4.7 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.4.6 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.4.5 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.4.4 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.4.3 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.4.2 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.4.12 | 1 | 7.5 | 5.8% | 0 | 0 |
| 3.4.11 | 1 | 7.5 | 5.8% | 0 | 0 |