CVE-2026-18754

9.1 CRITICAL

Published 2026-08-04 · Updated 2026-08-04

AI risk analysis

Summary: The flaw involves an embedded RSA private key in the Lighttpd firmware, allowing attackers to decrypt HTTPS traffic and spoof the server.
Exploitability: Exploitation requires access to the device's firmware, making it moderately difficult but feasible for advanced adversaries.
Blast radius: If exploited, this could compromise the confidentiality and integrity of all HTTPS communications on affected devices, with wide-ranging impacts.
Prioritized remediation: Update the firmware to remove or securely manage the embedded private key.

rsatlsencryptionwebfirmware

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-321

All references

https://www.geovision.com.tw/cyber_security.php

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.