CVE-2026-18754 describes a critical vulnerability in GeoVision product firmware where a static, embedded RSA private key is used by the Lighttpd web server for TLS termination. The hardcoded nature of this key means it is shared across all affected devices, allowing any attacker who obtains it to decrypt HTTPS traffic and perform server spoofing attacks. This compromises both the confidentiality and integrity of all TLS-protected communications on affected devices. The vulnerability is particularly dangerous in IoT and surveillance equipment contexts where firmware is widely distributed. Affected users are advised to consult GeoVision's security advisory for patches or mitigations.