CVE-2026-18753 describes a critical vulnerability in GeoVision product firmware where a static RSA private key is hardcoded and used by the Lighttpd web server for TLS termination. The exposure of this embedded private key allows malicious actors to decrypt HTTPS traffic and perform server spoofing attacks. This undermines both the confidentiality and integrity of encrypted communications between clients and the affected devices. Since the key is static and embedded in firmware, all devices running the affected firmware share the same key, greatly amplifying the impact. Exploitation does not require authentication and can be performed by any attacker with network access to intercepted traffic. The vulnerability is particularly dangerous in surveillance and physical security deployments where GeoVision devices are commonly used. GeoVision has published a security advisory on their website addressing the issue.