CVE-2026-18754
9.1 CRITICALPublished 2026-08-04 · Updated 2026-08-04
AI risk analysis
- Summary
- The flaw involves an embedded RSA private key in the Lighttpd web server firmware, allowing attackers to decrypt HTTPS traffic and spoof the server, compromising confidentiality and integrity.
- Exploitability
- Exploitation is relatively straightforward given access to the firmware, as the private key is static and embedded.
- Blast radius
- If exploited, this could lead to widespread decryption of sensitive communications and spoofing attacks affecting all users of the affected Lighttpd instances.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Disable TLS termination in Lighttpd or remove the embedded private key, and upgrade to a version that addresses this issue, such as 'Upgrade to 1.4.45 or later'.
tlsrsawebencryption
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-321
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-18753
- HIGHCVE-2026-60007PoC
- CRITICALCVE-2026-86246
- HIGHCVE-2026-28326
- HIGHCVE-2022-4997
- CRITICALCVE-2023-54399
- CRITICALCVE-2023-54400PoC
- HIGHCVE-2025-1281
Related by shared AI tags and CWE weakness class. Browse the full archive.