GeoVision GV-AS1620 CVE-2026-18753

Exploitation requires the GV-AS1620 to be using its firmware-embedded Lighttpd TLS interface (the default HTTPS management service) and the attacker to (1) obtain the static RSA private key by extracting it from the firmware image of any GV-AS1620 unit, and (2) achieve an interception or redirection position on the network path to the target's HTTPS traffic to decrypt sessions or spoof the server. Limiting factors: passive decryption is only fully effective against TLS sessions using RSA key exchange (forward-secret ECDHE sessions resist passive decryption even with the key, though the key still enables active impersonation), and active spoofing needs the attacker to be on-path (adjacent/MITM), so a remote attacker with no network vantage against the victim's traffic cannot exploit it despite the AV:N rating.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, base 9.1) rates this Critical with high confidentiality and integrity impact and no availability impact, consistent with a traffic-decryption and spoofing outcome. However, the AC:L / AV:N framing understates real-world prerequisites: exploitation practically requires the attacker to first obtain the static key from firmware and then achieve a man-in-the-middle position on the victim's network to intercept or redirect the HTTPS session - conditions better reflected by higher attack complexity. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input. The absence of KEV/POC signals suggests this is not currently subject to mass exploitation, but the shared-key nature makes it durable and attractive for targeted interception of access-control traffic. Net: a genuine and hard-to-remediate design flaw, but real-world impact is gated by network positioning rather than being trivially remotely triggerable.

An attacker downloads the GV-AS1620 firmware, extracts the embedded RSA private key, then positions on the same network segment as a target device (e.g., via ARP spoofing) to intercept the administrator's HTTPS session. Using the recovered key they decrypt captured credentials and access-control commands, or present a spoofed server certificate to impersonate the device and feed the operator forged responses. No POC was provided, but the attack requires only the static key plus a standard man-in-the-middle position.