CVE-2026-18753 CRITICAL

CVE-2026-18753: Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)

Vendor Geovision Inc.

Product GV-AS1620 (AS-Manager)

Weakness CWE-321

Published August 4, 2026

Last update August 4, 2026

View on NVD All CVEs

CVSS base score

9.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

Key dates

02Disclosure timeline

August 4, 2026 CVE published

August 4, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-18753 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/321.html AskarLabs — CWE-321 write-up Use of Hard-coded Cryptographic Key

Related vulnerabilities

04Related CVE

CVE-2024-13773 Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure CVE-2025-8625 Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution CVE-2023-3371 EmbedPress <= 3.7.3 - Sensitive Information Exposure CVE-2023-3947 Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure CVE-2025-12177 Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key