CVE-2026-18754 identifies a critical vulnerability in GeoVision Inc.'s GV-AS1620 (GV-Cloud) firmware version 1.16, where a static RSA private key is embedded in the product firmware and used by the Lighttpd web server for TLS termination. Exposure of this private key enables attackers to decrypt HTTPS traffic and impersonate the server, violating confidentiality and integrity protections. The vulnerability is classified under CWE-321 (Use of hard-coded cryptographic key). No vendor advisory or patch information is provided, and the product is not a cloud service, so remediation depends on vendor action.

The embedded static RSA private key compromises the security of TLS communications by allowing attackers to decrypt encrypted traffic and perform server spoofing attacks. This leads to a breach of confidentiality and integrity of HTTPS sessions, potentially exposing sensitive data and enabling man-in-the-middle attacks. The vulnerability has a CVSS v3.1 score of 9.1 (critical), reflecting its high impact and ease of exploitation without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor GeoVision Inc. communications for updates. Until a patch is available, consider restricting network access to the affected device and using additional network-level protections to mitigate exposure.