Security Advisory – October, 2026: Compromised eMudhra Intermediate CA Certificates Affecting Neat Devices and Cloud Services
Advisory ID: NEAT-SA-2026-10-22-2
Publication date: October 22, 2026
Last updated: November 6, 2026
Status: Fixed for Neat devices. Neat OS 26.5.4 (Stable channel) has been rolled out to all Neat devices. Neat OS 26.6.1 (Preview channel), released October 27, 2026, includes the same fix.
We have successfully deployed the fixes for Neat Pulse and Neat Open cloud services. No action is required on your part.
Severity: High. Neat has not independently scored this issue and has no evidence of exploitation.
CVSS vector: Not applicable. This is a third-party certificate authority issue, not a defect in Neat code.
CVE ID: No CVE has been assigned to the eMudhra CA compromise itself. Related vendor fixes: CVE-2026-111943 (Go), CVE-2026-113470 (Firefox).
Summary
On October 20, 2026, Mozilla and the Chrome Root Program confirmed that the private keys of eight intermediate certificate authority (CA) certificates operated by eMudhra (emSign brand) were compromised. The root certificates that issued these intermediates were present in the Neat OS trust store.
Neat OS 26.5.4 and Neat OS 26.6.1 remove trust in the compromised intermediates and their issuing roots.
Neat has also identified that certain outbound connections from the Neat Pulse and Neat Open cloud services were affected. Service-side fixes have been completed and do not require any customer action.
Affected Products
| Product | Affected versions | Fixed version |
|---|---|---|
| All Neat devices running NeatOS (Neat Bar, Neat Bar Generation 2, Neat Bar Pro, Neat Board, Neat Board 32, Neat Board 50, Neat Board Pro, Neat Frame, Neat Pad, Neat Pad Generation 2, Neat Pad Pro, Neat Center) | Neat OS 26.5.3 and earlier; Neat OS 26.6.0 (Preview channel) | Neat OS 26.5.4 (Stable channel); Neat OS 26.6.1 (Preview channel). See Remediation below. |
| Neat Pulse (cloud service) — outbound connections, such as webhook delivery | Current service | Service-side fix complete. No customer action required. |
| Neat Open (cloud service) — outbound connections, such as delivery of audio recordings | Current service | Service-side fix complete. No customer action required. |
The exposure is limited to outbound connections made by Neat devices and Neat cloud services that relied on trust stores including the affected roots (see Impact).
Impact
On devices not yet updated to Neat OS 26.5.4 or 26.6.1, an attacker would need two things: one of the compromised keys and a privileged position on the customer’s network (for example, the same network, or control of DNS). With both, they could present a forged certificate and intercept or alter TLS connections from a Neat device. This could affect device management connections, including Neat Pulse. Exploitation needs both the key and the network position, and it does not by itself allow remote code execution.
Neat devices and Neat Pulse have built-in protections that still apply in this scenario:
- Device-side remote control settings that Neat Pulse cannot override
- In-room approval or cancellation prompts before any remote control session starts
- A visible on-screen indicator for the full duration of a session, which can be ended from the device at any time
- Signed firmware: Neat OS updates are verified with Neat’s own signing keys. The compromised eMudhra keys cannot be used to deliver malicious firmware to Neat devices.
Neat cloud services: Certain outbound HTTPS connections from the Neat Pulse and Neat Open cloud services also trust the affected certificates. This would be considerably harder to exploit than the device-side scenario, because an attacker would need to intercept traffic between Neat’s cloud infrastructure and the destination service rather than on a customer network. If successful, an attacker could impersonate a destination service and receive data intended for it. For example, this could include Neat Pulse webhook event notifications (with any bearer token or basic authentication credentials configured for the webhook) or meeting audio recordings sent by Neat Open.
Details
According to the public disclosure, the CA generated the private keys incorrectly, so they can be recovered from the certificates themselves. The flaw has existed since the certificates were created in April 2025. A researcher reported it to the root programs on October 17, 2026. Chrome and Firefox blocked the certificates the same day, Apple on October 19 and Microsoft on October 20. eMudhra has since revoked them.
Browsers receive revocation data automatically. Embedded systems that rely on a static trust store, such as Neat OS, only stop trusting the certificates after a software update. The eight compromised intermediates are:
| Intermediate CA | Type | Chains to |
|---|---|---|
| EM DV TLS CA – G3B | TLS, domain validated | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM OV TLS CA – G3B | TLS, organization validated | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM EV TLS CA – G3B | TLS, extended validation | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM DV TLS CA – G3C | TLS, domain validated | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM OV TLS CA – G3C | TLS, organization validated | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM EV TLS CA – G3C | TLS, extended validation | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM OV CS CA – G3B | Code signing | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
| EM OV CS CA – G3C | Code signing | emSign ECC Root CA – G3; AAA Certificate Services (Sectigo cross-sign) |
Each intermediate also exists as a second certificate with the same public key, cross-signed by Sectigo under its AAA Certificate Services root. Consistent with the actions taken by Mozilla and other trust-store operators, Neat OS 26.5.4 and 26.6.1 remove trust in the compromised intermediates and the roots that issued them from the Neat OS trust store.
Neat’s own update, provisioning and Neat Pulse services do not use certificates issued by eMudhra. The exposure exists only because a device not yet updated to Neat OS 26.5.4 or 26.6.1 would accept a forged certificate for those services if it chained to one of the compromised intermediates.
Remediation
Update all Neat devices to Neat OS 26.5.4 or Neat OS 26.6.1. Devices on the Stable channel receive 26.5.4, and devices on the Preview channel receive 26.6.1. Both releases contain the same eMudhra trust store fix.
To check a device’s current firmware build, see How to check your software and firmware version, or view it in Neat Pulse. Any device still showing a previous build below should be updated.
Fixed builds by Neat model
| Neat model | Platform | Previous build (Neat OS 26.5.3) | Fixed build – Stable (Neat OS 26.5.4) | Fixed build – Preview (Neat OS 26.6.1) |
|---|---|---|---|---|
| Neat Bar | Android 10 | NFB1.20260810.1020 | NFB1.20260810.1026 | NFB1.20261012.1010 |
| Neat Board | Android 10 | NFC1.20260810.1020 | NFC1.20260810.1026 | NFC1.20261012.1010 |
| Neat Bar Generation 2 | Android 13 | NFE2.20260810.1322 | NFE2.20260810.1328 | NFE2.20261012.1318 |
| Neat Bar Pro | Android 13 | NFD2.20260810.1322 | NFD2.20260810.1328 | NFD2.20261012.1318 |
| Neat Board 50 | Android 13 | NFH2.20260810.1322 | NFH2.20260810.1328 | NFH2.20261012.1314 |
| Neat Board Pro | Android 13 | NFK2.20260810.1322 | NFK2.20260810.1328 | NFK2.20261012.1314 |
| Neat Frame | Android 13 | NFF2.20260810.1322 | NFF2.20260810.1328 | NFF2.20261012.1314 |
| Neat Pad | Android 13 | NFA2.20260810.1320 | NFA2.20260810.1326 | NFA2.20261012.1310 |
| Neat Board 32 | Android 15 | NFM2.20260810.1524 | NFM2.20260810.1538 | NFM2.20261012.1520 |
| Neat Pad Generation 2 | Android 15 | NFA5.20260810.1522 | NFA5.20260810.1534 | NFA5.20261012.1514 |
| Neat Pad Pro | Android 15 | NFJ2.20260810.1524 | NFJ2.20260810.1538 | NFJ2.20261012.1520 |
| Neat Center | Android 15 | NFL2.20260810.1524 | NFL2.20260810.1538 | NFL2.20261012.1520 |
The Zoom Rooms, Microsoft Teams and Google Meet app versions in Neat OS 26.5.4 are unchanged from Neat OS 26.5.3. For full details of each release, including app versions, see the Neat OS 26.5.4 release notes and the Neat Preview Channel release notes (Neat OS 26.6.1).
Neat Pulse and Neat Open cloud services: Service-side fixes have been completed and do not require any customer action.
Additional recommended actions
These steps remain good practice, and they are especially important for any device that cannot be updated immediately:
- Limit network exposure: Use network segmentation, and restrict outbound traffic from Neat devices to the endpoints listed in Neat’s network and firewall requirements. This reduces the network access an attacker would need.
- Review remote control settings: Consider setting the device remote control option to Allowed with Confirmation or Not Allowed, particularly in rooms that are often unattended.
- Monitor TLS inspection logs: Organizations that perform TLS inspection can check for certificates chaining to emSign ECC Root CA – G3 or the intermediates listed above. They should also make sure their own inspection appliances and trust stores are updated.
- Rotate webhook credentials (optional): Neat Pulse customers whose webhook endpoints use bearer token or basic authentication may wish to rotate those credentials once Neat confirms that the cloud service fix is complete. HMAC signing secrets are not transmitted and do not need to be rotated.
Important: impact on customer-hosted and third-party services
Removing the affected roots also removes trust in legitimate certificates issued under them. After updating to Neat OS 26.5.4 or 26.6.1, a Neat device will be unable to connect to any service that uses an emSign-issued certificate. This includes customer-hosted services (for example, a proxy, a SIP endpoint or a web application shown on the device) and third-party services. If you are affected, get a replacement certificate from a different CA, or contact the third-party provider.
Acknowledgements
Not applicable, because this issue was not reported directly to Neat. A researcher credited as Wayne reported the compromise to the root programs, and Dennis Jackson (Mozilla) documented it publicly.
References
- Neat OS 26.5.4 release notes
- Neat Preview Channel release notes (Neat OS 26.6.1)
- eMudhra Intermediate CA Compromise: disclosure site
- Mozilla: Protecting Firefox users following the compromise of eMudhra intermediate certificates
- Mozilla dev-security-policy thread
- Mozilla Bugzilla: initial incident report
- Neat network and firewall requirements
- How to Use Remote Control in Neat Pulse
- Neat Pulse Security White Paper
Contact
Questions about this advisory can be directed to security@neat.no.
Revision History
| Date | Change |
|---|---|
| November 6, 2026 | Neat Pulse and Neat Open service-side fixes have been completed and do not require any customer action. |
| October 30, 2026 | Neat OS 26.5.4 rollout complete. Neat OS 26.6.1 (Preview channel) added as a fixed version. Status, Affected Products, Details and Remediation updated, including 26.6.1 build numbers and release note references. |
| October 26, 2026 | Summary edited |
| October 23, 2026 | Roll-out of Neat OS 26.5.4 Hotfix |
| October 22, 2026 | Initial publication (interim) |