CVE-2026-18754

Name of the Vulnerable Software and Affected Versions GV-AS1620 Controller Firmware (GV-Cloud) (affected versions not specified)

Description The product firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. TLS termination is the process of decrypting encrypted traffic at the server end. The exposure of this private key allows attackers to compromise the confidentiality and integrity of HTTPS communications, which can lead to traffic decryption and server spoofing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.