CVE-2026-18754CWE-321

CVE-2026-18754

Critical · published August 4, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

The

product firmware contains an embedded, static RSA private key utilized by the

Lighttpd web server for TLS termination. Exposure of this private key allows

malicious actors to breach the confidentiality and integrity of HTTPS

communications, enabling traffic decryption and server spoofing.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00440 · 37.2th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2026-08-04T12:16Z
References (1)
https://www.geovision.com.tw/cyber_security.php · 0df08a0e-a200-4957-9bb0-084f562506f9
EPSS history
Timeline
  • 04 AUG 07:09Z
    Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)
    cvelistv5