CVE-2026-18754

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18754", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "state": "PUBLISHED", "assignerShortName": "GV", "dateReserved": "2026-08-04T00:55:06.145Z", "datePublished": "2026-08-04T07:09:17.493Z", "dateUpdated": "2026-08-04T15:03:03.492Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-08-04T07:09:17.493Z"}, "title": "Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)", "datePublic": "2026-08-04T00:55:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-321", "description": "CWE-321 Use of hard-coded cryptographic key", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-633", "descriptions": [{"lang": "en", "value": "CAPEC-633 Token Impersonation"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-AS1620 (GV-Cloud)", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "V1.16"}, {"status": "unaffected", "version": "V1.17"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The\nproduct firmware contains an embedded, static RSA private key utilized by the\nLighttpd web server for TLS termination. Exposure of this private key allows\nmalicious actors to breach the confidentiality and integrity of HTTPS\ncommunications, enabling traffic decryption and server spoofing.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The\nproduct firmware contains an embedded, static RSA private key utilized by the\nLighttpd web server for TLS termination. Exposure of this private key allows\nmalicious actors to breach the confidentiality and integrity of HTTPS\ncommunications, enabling traffic decryption and server spoofing.</p>"}]}], "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "credits": [{"lang": "en", "value": "Lloyd Lexter Gealon", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T14:38:28.332319Z", "id": "CVE-2026-18754", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T15:03:03.492Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18754", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-04T14:38:28.332319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T14:38:34.869Z"}}], "cna": {"title": "Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Lloyd Lexter Gealon"}], "impacts": [{"capecId": "CAPEC-633", "descriptions": [{"lang": "en", "value": "CAPEC-633 Token Impersonation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GeoVision Inc.", "product": "GV-AS1620 (GV-Cloud)", "versions": [{"status": "affected", "version": "V1.16"}, {"status": "unaffected", "version": "V1.17"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "datePublic": "2026-08-04T00:55:00.000Z", "references": [{"url": "https://www.geovision.com.tw/cyber_security.php", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "The\nproduct firmware contains an embedded, static RSA private key utilized by the\nLighttpd web server for TLS termination. Exposure of this private key allows\nmalicious actors to breach the confidentiality and integrity of HTTPS\ncommunications, enabling traffic decryption and server spoofing.", "supportingMedia": [{"type": "text/html", "value": "<p>The\nproduct firmware contains an embedded, static RSA private key utilized by the\nLighttpd web server for TLS termination. Exposure of this private key allows\nmalicious actors to breach the confidentiality and integrity of HTTPS\ncommunications, enabling traffic decryption and server spoofing.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "CWE-321 Use of hard-coded cryptographic key"}]}], "providerMetadata": {"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "shortName": "GV", "dateUpdated": "2026-08-04T07:09:17.493Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18754", "state": "PUBLISHED", "dateUpdated": "2026-08-04T15:03:03.492Z", "dateReserved": "2026-08-04T00:55:06.145Z", "assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9", "datePublished": "2026-08-04T07:09:17.493Z", "assignerShortName": "GV"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "GV-AS1620 (GV-Cloud)", "vendor": "GeoVision Inc.", "versions": [{"status": "affected", "version": "V1.16"}, {"status": "unaffected", "version": "V1.17"}]}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The\nproduct firmware contains an embedded, static RSA private key utilized by the\nLighttpd web server for TLS termination. Exposure of this private key allows\nmalicious actors to breach the confidentiality and integrity of HTTPS\ncommunications, enabling traffic decryption and server spoofing."}, {"lang": "es", "value": "El firmware del producto contiene una clave privada RSA est\u00e1tica incrustada utilizada por el servidor web Lighttpd para la terminaci\u00f3n TLS. La exposici\u00f3n de esta clave privada permite a actores maliciosos comprometer la confidencialidad y la integridad de las comunicaciones HTTPS, lo que permite el descifrado del tr\u00e1fico y la suplantaci\u00f3n del servidor."}], "id": "CVE-2026-18754", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18754", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T14:38:28.332319Z", "version": "2.0.3"}}]}, "published": "2026-08-04T08:16:34.803", "references": [{"source": "0df08a0e-a200-4957-9bb0-084f562506f9", "url": "https://www.geovision.com.tw/cyber_security.php"}], "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}], "source": "0df08a0e-a200-4957-9bb0-084f562506f9", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "V1.16"}}, {"platform": ["linux"], "status": "unaffected", "versions": {"scheme": "generic", "value": "V1.17"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "GV-AS1620 (GV-Cloud)", "source": "cna", "vendor": "GeoVision Inc."}, "product": "gv-as1620_(gv-cloud)", "vendor": "geovision_inc."}], "created": "2026-08-04T09:15:03.477726+00:00", "updated": "2026-08-05T10:21:12.955482+00:00", "vendors": ["geovision_inc.", "geovision_inc.$PRODUCT$gv-as1620_(gv-cloud)"]}