Paper/Archive/CVE-2026-18754

CVE-2026-18754

GeoVision Inc. GV-AS1620 (GV-Cloud) — Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 38.2.382 × 207.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

Affected

ProductAffectedFixed inSource

GV-AS1620 (GV-Cloud)V1.16V1.17CNA

Scores by source

GV (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygeovision.com.tw/cyber_security.php