CVE-2026-18753
9.1 CRITICALPublished 2026-08-04 · Updated 2026-08-04
AI risk analysis
- Summary
- The flaw involves an embedded RSA private key in the Lighttpd web server firmware, allowing attackers to decrypt HTTPS traffic and spoof the server, compromising confidentiality and integrity.
- Exploitability
- Exploitation is relatively straightforward given access to the firmware, as the private key is static and embedded.
- Blast radius
- If exploited, this flaw could impact any HTTPS traffic handled by the affected Lighttpd server, leading to potential data breaches and server impersonation.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Disable TLS termination in Lighttpd or remove the embedded private key from the firmware.
tlsrsawebconfidentialityintegrity
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-321
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-18754
- HIGHCVE-2026-16604
- HIGHCVE-2026-83621PoC
- HIGHCVE-2026-28326
- HIGHCVE-2022-4997
- CRITICALCVE-2023-54399
- CRITICALCVE-2023-54400PoC
- HIGHCVE-2025-1281
Related by shared AI tags and CWE weakness class. Browse the full archive.