CVE-2026-18753

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.geovision.com.tw/cyber_security.php

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El firmware del producto contiene una clave privada RSA estática e incrustada utilizada por el servidor web Lighttpd para la terminación TLS. La exposición de esta clave privada permite a actores maliciosos comprometer la confidencialidad y la integridad de las comunicaciones HTTPS, lo que permite el descifrado del tráfico y la suplantación del servidor.

Information

Published : 2026-08-04 08:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-18753

Mitre link : CVE-2026-18753

CVE.ORG link : CVE-2026-18753

JSON object : View

Products Affected

No product.

CWE

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2026-18753", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18753", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-04T13:35:04.169419Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "affectedData": [{"vendor": "GeoVision Inc.", "product": "GV-AS1620 (AS-Manager)", "versions": [{"status": "affected", "version": "V2.07"}, {"status": "unaffected", "version": "V2.08"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-08-04T08:16:34.640", "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "The\nproduct firmware contains an embedded, static RSA private key utilized by the\nLighttpd web server for TLS termination. Exposure of this private key allows\nmalicious actors to breach the confidentiality and integrity of HTTPS\ncommunications, enabling traffic decryption and server spoofing."}, {"lang": "es", "value": "El firmware del producto contiene una clave privada RSA est\u00e1tica e incrustada utilizada por el servidor web Lighttpd para la terminaci\u00f3n TLS. La exposici\u00f3n de esta clave privada permite a actores maliciosos comprometer la confidencialidad y la integridad de las comunicaciones HTTPS, lo que permite el descifrado del tr\u00e1fico y la suplantaci\u00f3n del servidor."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9"}