CVE-2026-18753

Published: Aug 4, 2026Modified: Aug 4, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 0df08a0e-a200-4957-9bb0-084f562506f9 (Secondary)

Description

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

Related CWEs

CWE-321

Use of Hard-coded Cryptographic Key

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

References (1)

https://www.geovision.com.tw/cyber_security.php

Source: 0df08a0e-a200-4957-9bb0-084f562506f9

Timeline

No history available yet.