CVE-2026-18753
Received Received - Intake

Hard-Coded RSA Private Key in Product Firmware

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: 0df08a0e-a200-4957-9bb0-084f562506f9

Description
The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-18753
EUVD
EUVD-2026-52637

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lighttpd lighttpd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a static RSA private key embedded in the product firmware used by the Lighttpd web server for TLS termination. The key is hardcoded, meaning it does not change and is exposed, allowing attackers to decrypt HTTPS traffic and impersonate the server.

Detection Guidance

Detecting this vulnerability requires checking for the presence of a static RSA private key in the Lighttpd web server's firmware or configuration. Inspect configuration files and firmware images for hardcoded private keys. Use commands like 'grep -r "PRIVATE KEY" /etc/lighttpd/' or examine firmware binaries with 'binwalk' or 'strings' to search for key material.

Impact Analysis

Attackers can decrypt sensitive HTTPS communications, steal data, or perform man-in-the-middle attacks to impersonate the server. This compromises confidentiality and integrity of all transmitted information.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and encryption, such as GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Non-compliance risks legal penalties and reputational damage.

Mitigation Strategies

Immediately replace the static RSA private key with a newly generated one. Update Lighttpd to the latest version if a patch is available. Restrict network access to the web server and monitor HTTPS traffic for anomalies. Rotate any certificates or keys derived from the compromised private key.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18753. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart