Vulnerability · Published Aug 4, 2026 · Assigned by GV
CVE-2026-18753Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)
Critical 9.1
In plain English
A critical-severity security flaw in GV-AS1620 (AS-Manager) from GeoVision Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.4%top 61.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GeoVision Inc. | GV-AS1620 (AS-Manager) | V2.07 |
Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://www.geovision.com.tw/cyber_security.php vendor-advisory