CVE-2026-18754

critical · 9.1

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

9.1

CVSS

0.3%

EPSS (exploit prob.)

24th

EPSS percentile

2026-08-04

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-321

References

https://www.geovision.com.tw/cyber_security.php

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-18754