CVE-2026-18754
Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)
- State
- Published
- Severity
- 9.1 Critical
- Published
- Aug 4, 2026
- Updated
- Aug 4, 2026
- Reserved
- Aug 4, 2026
Description
The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | GV |
Weaknesses
- CWE-321 Use of hard-coded cryptographic key
Affected Products
| Product | Versions |
|---|---|
GV-AS1620 (GV-Cloud)GeoVision Inc. |
|
References
- https://www.geovision.com.tw/cyber_security.phpvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.