Description
The
product firmware contains an embedded, static RSA private key utilized by the
Lighttpd web server for TLS termination. Exposure of this private key allows
malicious actors to breach the confidentiality and integrity of HTTPS
communications, enabling traffic decryption and server spoofing.
Published: 2026-08-04
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The firmware for GeoVision's GV‑AS1620 controller embeds a static RSA private key used by Lighttpd for TLS termination, a textbook example of CWE‑321: Hard‑Coded Cryptographic Key. When the key becomes exposed, an attacker can decrypt HTTPS traffic and spoof the controller, thereby breaching confidentiality and integrity of communications.

Affected Systems

This vulnerability affects GeoVision Inc.'s GV‑AS1620 controller running the GV‑Cloud firmware. No specific firmware version range is stated, so all releases that include the embedded key are potentially impacted.

Risk and Exploitability

With a CVSS score of 9.1 the vulnerability is considered critical. No EPSS score is available and it is not listed in the CISA KEV catalog. The likely attack vector is exposure of the firmware or unauthorized access to the device, after which the static key can be extracted and used to decrypt live TLS sessions or impersonate the controller. Successful exploitation would allow traffic eavesdropping and denial of service through spoofing.

Generated by OpenCVE AI on August 4, 2026 at 09:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Replace the controller firmware with the latest GeoVision release that removes the hardcoded RSA key.
  • Configure Lighttpd to use a certificate issued by a trusted CA and stored securely in external storage instead of the bundled key.
  • If an update is not immediately available, isolate the controller from untrusted networks, monitor for TLS anomalies, and consider terminating HTTPS services until the key is changed.

Generated by OpenCVE AI on August 4, 2026 at 09:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Geovision Inc.
Geovision Inc. gv-as1620 (gv-cloud)
Vendors & Products Geovision Inc.
Geovision Inc. gv-as1620 (gv-cloud)

Tue, 04 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.
Title Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)
Weaknesses CWE-321
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Geovision Inc. Gv-as1620 (gv-cloud)
cve-icon MITRE

Status: PUBLISHED

Assigner: GV

Published:

Updated: 2026-08-04T15:03:03.492Z

Reserved: 2026-08-04T00:55:06.145Z

Link: CVE-2026-18754

cve-icon Vulnrichment

Updated: 2026-08-04T14:38:34.869Z

cve-icon NVD

Status : Received

Published: 2026-08-04T08:16:34.803

Modified: 2026-08-04T16:16:22.133

Link: CVE-2026-18754

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T10:21:12Z

Weaknesses
  • CWE-321

    Use of Hard-coded Cryptographic Key