The GV-AS1620 (GV-Cloud) firmware version 1.16 embeds a static RSA private key within the Lighttpd web server used for TLS termination. This hard-coded cryptographic key (CWE-321) can be extracted by malicious actors, enabling them to decrypt HTTPS traffic and impersonate the server. This undermines the security guarantees of TLS, allowing breaches of confidentiality and integrity of communications. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity. No official patch or remediation has been published yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability allows attackers to decrypt encrypted HTTPS traffic and perform server spoofing attacks. This compromises the confidentiality and integrity of communications between clients and the affected device. The vulnerability does not impact availability. Given the critical CVSS score, the risk to sensitive data and secure communications is high.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider limiting exposure of the affected device to untrusted networks and using network-level protections such as VPNs or secure tunnels to mitigate interception risks.