Embedded Static RSA Private Key Vulnerability in Lighttpd Web Server by GeoVision
CVE-2026-18754

9.1CRITICAL

Key Information:

Vendor: Geovision Inc.
Status: Gv-as1620 (gv-cloud)
Vendor: CVE Published:; 4 August 2026

🔔 Create Geovision Inc. Vulnerability Alert

What is CVE-2026-18754?

The firmware of the Lighttpd web server utilized by GeoVision contains an embedded static RSA private key, which is critical for TLS termination. This private key's exposure poses significant risks, enabling attackers to decrypt HTTPS communications and impersonate the server, thus jeopardizing both data confidentiality and integrity. Organizations using affected versions must assess their security posture and implement measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

GV-AS1620 (GV-Cloud) Linux V1.16

GV-AS1620 (GV-Cloud) Linux V1.17

References

https://www.geovision.com.tw/cyber_security.php

vendor-advisory

CVSS V3.1

Score:

9.1

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 4, 2026
Vulnerability Reserved
Aug 4, 2026

Credit

Lloyd Lexter Gealon

CVE-2026-18754 Data

JSON