CVE-2026-18754
Received Received - Intake

Static RSA Private Key Exposure in Lighttpd Web Server Firmware

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: 0df08a0e-a200-4957-9bb0-084f562506f9

Description
The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-18754
EUVD
EUVD-2026-52638

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lighttpd lighttpd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a static RSA private key embedded in the product firmware used by the Lighttpd web server for TLS termination. The key is hardcoded and exposed, allowing attackers to decrypt HTTPS traffic and impersonate the server.

Impact Analysis

Attackers can intercept and decrypt sensitive communications, steal data, or perform man-in-the-middle attacks to impersonate the server. This compromises confidentiality and integrity of all HTTPS traffic.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (e.g., GDPR, HIPAA) due to unauthorized access to encrypted data. Organizations may face legal penalties for failing to protect sensitive information.

Mitigation Strategies

Replace the static RSA private key in the firmware with a newly generated one. Ensure the Lighttpd web server is configured to use this new key for TLS termination to prevent decryption and spoofing attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18754. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart