CVE-2026-18754
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The product firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. Exposure of this key allows attackers to breach HTTPS confidentiality and integrity, enabling traffic decryption and server spoofing.
Risk Assessment
Exposure of the private key allows an attacker to intercept and read encrypted traffic and impersonate the server, potentially leading to data theft and loss of trust.
Recommendation
Replace the static RSA key with a unique per-device key and update the firmware to remove the embedded key.
Original NVD description (English source)
The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.