CVE-2026-18754

Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

View on CVE.org
Published Aug 4, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
The
product firmware contains an embedded, static RSA private key utilized by the
Lighttpd web server for TLS termination. Exposure of this private key allows
malicious actors to breach the confidentiality and integrity of HTTPS
communications, enabling traffic decryption and server spoofing.

Analysis

AI-generated

Technical impact

The firmware for GeoVision's GV‑AS1620 controller embeds a static RSA private key used by Lighttpd for TLS termination, a textbook example of CWE‑321: Hard‑Coded Cryptographic Key. When the key becomes exposed, an attacker can decrypt HTTPS traffic and spoof the controller, thereby breaching confidentiality and integrity of communications.

Affected Systems

This vulnerability affects GeoVision Inc.'s GV‑AS1620 controller running the GV‑Cloud firmware. No specific firmware version range is stated, so all releases that include the embedded key are potentially impacted.

Risk and Exploitability

With a CVSS score of 9.1 the vulnerability is considered critical. No EPSS score is available and it is not listed in the CISA KEV catalog. The likely attack vector is exposure of the firmware or unauthorized access to the device, after which the static key can be extracted and used to decrypt live TLS sessions or impersonate the controller. Successful exploitation would allow traffic eavesdropping and denial of service through spoofing.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Replace the controller firmware with the latest GeoVision release that removes the hardcoded RSA key.
  • Configure Lighttpd to use a certificate issued by a trusted CA and stored securely in external storage instead of the bundled key.
  • If an update is not immediately available, isolate the controller from untrusted networks, monitor for TLS anomalies, and consider terminating HTTPS services until the key is changed.

Generated by OpenCVE AI on August 4, 2026 at 09:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Geovision Inc.
Geovision Inc. gv-as1620 (gv-cloud)
Vendors & Products Geovision Inc.
Geovision Inc. gv-as1620 (gv-cloud)
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.
Title Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)
Weaknesses CWE-321
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}
Weaknesses
  • CWE-321

    Use of Hard-coded Cryptographic Key

Sources

Status
PUBLISHED
Assigner
GV
Published
Updated
Aug 4, 2026, 3:03 PM
Reserved
Aug 4, 2026, 12:55 AM

View source JSON

Updated
Aug 4, 2026, 2:38 PM

JSON

Status
Deferred
Published
Aug 4, 2026, 8:16 AM
Modified
Oct 23, 2026, 11:10 PM

View source JSON

No data.

Updated
Aug 5, 2026, 10:21 AM

JSON