CVE-2026-18753: GeoVision Inc Gv-AS1620 As-Manager

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

Affected products

• GeoVision Inc Gv-AS1620 As-Manager: version V2.07 only

Published 2026-08-04. Last modified 2026-09-09.