CVE-2026-18754

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

Score

CVSS 3.1 9.1 Critical

Status

Deferred - 0df08a0e-a200-4957-9bb0-084f562506f9

Published

2026-08-04

Last modified

2026-10-23

Weaknesses

CWE-321

Affected products

• Gv-as1620 Gv-cloud (Geovision Inc.)

References

• https://www.geovision.com.tw/cyber_security.php