{"id":"CVE-2026-18753","state":"PUBLISHED","title":"Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)","description":"The\nproduct firmware contains an embedded, static RSA private key utilized by the\nLighttpd web server for TLS termination. Exposure of this private key allows\nmalicious actors to breach the confidentiality and integrity of HTTPS\ncommunications, enabling traffic decryption and server spoofing.","publishedAt":"2026-08-04T07:08:40.650Z","updatedAt":"2026-08-04T13:36:24.896Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"GV"},"assigner":"GV","products":["GeoVision Inc. GV-AS1620 (AS-Manager)"],"affected":[{"vendor":"GeoVision Inc.","product":"GV-AS1620 (AS-Manager)","defaultStatus":"unaffected","versions":[{"version":"V2.07","status":"affected"},{"version":"V2.08","status":"unaffected"}],"platforms":["Linux"]}],"references":["https://www.geovision.com.tw/cyber_security.php"],"weaknesses":["CWE-321"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/18xxx/CVE-2026-18753.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-18753","state":"PUBLISHED","datePublished":"2026-08-04T07:08:40.650Z","dateUpdated":"2026-08-04T13:36:24.896Z","assignerShortName":"GV","assignerOrgId":"0df08a0e-a200-4957-9bb0-084f562506f9","dateReserved":"2026-08-04T00:55:05.974Z"},"containers":{"cna":{"title":"Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)","descriptions":[{"lang":"en","value":"The\nproduct firmware contains an embedded, static RSA private key utilized by the\nLighttpd web server for TLS termination. Exposure of this private key allows\nmalicious actors to breach the confidentiality and integrity of HTTPS\ncommunications, enabling traffic decryption and server spoofing."}],"affected":[{"vendor":"GeoVision Inc.","product":"GV-AS1620 (AS-Manager)","defaultStatus":"unaffected","versions":[{"version":"V2.07","status":"affected"},{"version":"V2.08","status":"unaffected"}],"platforms":["Linux"]}],"references":[{"url":"https://www.geovision.com.tw/cyber_security.php","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"CRITICAL","baseScore":9.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-321","lang":"en","description":"CWE-321 Use of hard-coded cryptographic key","type":"CWE"}]}],"providerMetadata":{"shortName":"GV","orgId":"0df08a0e-a200-4957-9bb0-084f562506f9","dateUpdated":"2026-08-04T07:08:40.650Z"},"datePublic":"2026-08-04T00:55:00.000Z","impacts":[{"capecId":"CAPEC-633","descriptions":[{"lang":"en","value":"CAPEC-633 Token Impersonation"}]}],"credits":[{"lang":"en","value":"Lloyd Lexter Gealon","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-04T13:35:04.169419Z","id":"CVE-2026-18753","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-04T13:36:24.896Z"}}]}}}