Security Advisory – October, 2026: Compromised eMudhra Intermediate CA Certificates Affecting Neat Devices and Cloud Services
Advisory ID: NEAT-SA-2026-10-22-2
Publication date: October 22, 2026
Last updated: October 23, 2026
Status: Neat OS 26.5.4, an emergency security hotfix, will be available in a staged rollout to all Neat devices beginning on Monday, October 26, 2026, and will reach all customers over the following days.
Neat Pulse and Neat Open cloud service fixes are rolling out within the next two weeks. This advisory will be updated as each fix is released.
Severity: High — not independently scored by Neat. Neat has no evidence of exploitation.
CVSS vector: Not applicable — third-party certificate authority issue, not a defect in Neat code
CVE ID: None assigned to the eMudhra CA compromise itself. Related vendor fixes: CVE-2026-111943 (Go), CVE-2026-113470 (Firefox).
Summary
On October 20, 2026, Mozilla and the Chrome Root Program confirmed that the private keys of eight intermediate certificate authority (CA) certificates operated by eMudhra (emSign brand) were compromised. Neat has confirmed that the root certificates that issued these intermediates are present in the Neat OS trust store. Neat is preparing an emergency Neat OS firmware update, expected in the coming days, that removes trust in the affected certificates. Until then, customers can reduce exposure using the steps under Remediation.
Neat has also identified that certain outbound connections from Neat Pulse and Neat Open cloud services are affected. Service-side fixes are being rolled out over the next two weeks and require no customer action.
Affected Products
| Product | Affected versions | Fixed version |
|---|---|---|
| All Neat devices running NeatOS (Neat Bar, Neat Bar Generation 2, Neat Bar Pro, Neat Board, Neat Board 32, Neat Board 50, Neat Board Pro, Neat Frame, Neat Pad, Neat Pad Generation 2, Neat Pad Pro, Neat Center) | All current NeatOS releases | Neat OS 26.5.4 hotfix Refer to Remediation section below |
| Neat Pulse (cloud service) — outbound connections, such as webhook delivery | Current service | Service-side fix expected over the next 2 weeks; no customer action required |
| Neat Open (cloud service) — outbound connections, such as delivery of audio recordings | Current service | Service-side fix expected over the next 2 weeks; no customer action required |
The exposure is limited to connections that Neat devices and Neat cloud services make outbound, which rely on trust stores that currently include the affected roots (see Impact).
Impact
An attacker holding one of the compromised keys and a privileged position on the customer’s network (for example, on the same network or controlling DNS) could present a forged certificate and intercept or alter TLS connections from a Neat device. This could affect device management connections, including Neat Pulse. Exploitation requires both a compromised key and an on-path network position; it does not on its own allow remote code execution.
Neat devices and Neat Pulse include built-in protections that continue to apply in this scenario:
- Device-side remote control settings that Neat Pulse cannot override
- In-room approval or cancellation prompts before any remote control session starts
- A visible on-screen indicator for the full duration of a session, which can be ended from the device at any time
- Signed firmware: Neat OS updates are verified with Neat’s own signing keys. The compromised eMudhra keys cannot be used to deliver malicious firmware to Neat devices.
Neat cloud services: Certain outbound HTTPS connections made by Neat Pulse and Neat Open cloud services also trust the affected certificates. Exploiting this would be considerably harder than the device-side scenario: an attacker would need to intercept traffic between Neat’s cloud infrastructure and the destination service, rather than on a customer network. If successful, an attacker could impersonate a destination service and receive data intended for it — for example, Neat Pulse webhook event notifications (including any bearer token or basic authentication credentials configured for the webhook), or meeting audio recordings sent by Neat Open.
Details
According to the public disclosure, the private keys were incorrectly generated by the CA, making them recoverable from the certificates themselves. The flaw has existed since the certificates were created in April 2025. A researcher reported it to the root programs on October 17, 2026; Chrome and Firefox blocked the certificates the same day, Apple on October 19 and Microsoft on October 20. eMudhra has since revoked them.
Browsers receive revocation data automatically, but embedded systems that rely on a static trust store, such as Neat OS, only stop trusting the certificates after a software update. The eight compromised intermediates are:
| Intermediate CA | Type | Chains to |
|---|---|---|
| EM DV TLS CA – G3B | TLS, domain validated | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM OV TLS CA – G3B | TLS, organization validated | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM EV TLS CA – G3B | TLS, extended validation | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM DV TLS CA – G3C | TLS, domain validated | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM OV TLS CA – G3C | TLS, organization validated | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM EV TLS CA – G3C | TLS, extended validation | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM OV CS CA – G3B | Code signing | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM OV CS CA – G3C | Code signing | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
Each intermediate also exists as a second certificate with the same public key, cross-signed by Sectigo under its AAA Certificate Services root. The upcoming Neat OS update will remove trust in the compromised intermediates and the roots that issued them from the Neat OS trust store, consistent with the actions taken by Mozilla and other trust-store operators.
Neat’s own update, provisioning, and Neat Pulse services do not use certificates issued by eMudhra. The exposure exists because, until the update is installed, a Neat device would accept a forged certificate for those services if it chained to one of the compromised intermediates.
Remediation
Release by Neat model:
The security fix applies to every Neat model listed below. To check your device’s current firmware build, see How to check your software and firmware version or view it in Neat Pulse.
| Neat model | Platform | Previous build (Neat OS 26.5.3) | New build (Neat OS 26.5.4) |
|---|---|---|---|
| Neat Bar | Android 10 | NFB1.20260810.1020 | NFB1.20260810.1026 |
| Neat Board | Android 10 | NFC1.20260810.1020 | NFC1.20260810.1026 |
| Neat Bar Generation 2 | Android 13 | NFE2.20260810.1322 | NFE2.20260810.1328 |
| Neat Bar Pro | Android 13 | NFD2.20260810.1322 | NFD2.20260810.1328 |
| Neat Board 32 | Android 15 | NFM2.20260810.1524 | NFM2.20260810.1538 |
| Neat Board 50 | Android 13 | NFH2.20260810.1322 | NFH2.20260810.1328 |
| Neat Board Pro | Android 13 | NFK2.20260810.1322 | NFK2.20260810.1328 |
| Neat Frame | Android 13 | NFF2.20260810.1322 | NFF2.20260810.1328 |
| Neat Pad | Android 13 | NFA2.20260810.1320 | NFA2.20260810.1326 |
| Neat Pad Generation 2 | Android 15 | NFA5.20260810.1522 | NFA5.20260810.1534 |
| Neat Pad Pro | Android 15 | NFJ2.20260810.1524 | NFJ2.20260810.1538 |
| Neat Center | Android 15 | NFL2.20260810.1524 | NFL2.20260810.1538 |
The Zoom Rooms, Microsoft Teams, and Google Meet app versions are unchanged from Neat OS 26.5.3.
Neat Pulse and Neat Open cloud services: service-side fixes for affected outbound connections are rolling out separately, with completion expected within the next two weeks. No action is needed. We will update the security advisory when this work is complete; Neat Pulse customers using bearer token or basic authentication for webhooks may then wish to rotate those credentials.
Recommended actions until the update is available:
- Limit network exposure: Use network segmentation and restrict Neat device outbound traffic to the endpoints listed in Neat’s network and firewall requirements. This reduces the network access an attacker would need.
- Review remote control settings: Consider setting the device remote control option to Allowed with Confirmation or Not Allowed, particularly for devices in rooms that are frequently unattended.
- Monitor TLS inspection logs: Organizations that perform TLS inspection can check for certificates chaining to emSign ECC Root CA – G3 or the intermediates listed above, and should ensure their own inspection appliances and trust stores are updated.
- Rotate webhook credentials (optional): Neat Pulse customers whose webhook endpoints use bearer token or basic authentication may wish to rotate those credentials once Neat confirms the cloud service fix is complete. HMAC signing secrets are not transmitted and do not need rotation.
Note: Removing the affected roots also removes trust in legitimate certificates issued under them. After the update, a Neat device may be unable to connect to a customer-hosted service (for example, a proxy, SIP endpoint, or web application shown on the device) that uses an emSign-issued certificate. Customers in this situation should obtain a replacement certificate from a different CA.
Acknowledgements
Not applicable — this issue was not reported directly to Neat. The compromise was reported to the root programs by a researcher credited as Wayne and publicly documented by Dennis Jackson (Mozilla).
References
- eMudhra Intermediate CA Compromise — disclosure site
- Mozilla: Protecting Firefox users following the compromise of eMudhra intermediate certificates
- Mozilla dev-security-policy thread
- Mozilla Bugzilla — initial incident report
- Neat network and firewall requirements
- How to Use Remote Control in Neat Pulse
- Neat Pulse Security White Paper
Contact
Questions about this advisory can be directed to security@neat.no.
Revision History
| Date | Change |
|---|---|
| October 22, 2026 | Initial publication (interim) |
| October 23, 2026 | Roll-out of Neat OS 26.5.4 Hotfix |