A private RSA key embedded in Lighttpd firmware during the build process earned this CVE a 9.1 severity — and the score is warranted. The key authenticates TLS termination on every device running this firmware. If an adversary obtains the firmware image, they can extract the key and decrypt traffic across the entire deployed fleet, not just one device. This is not a contained breach; it's a master key to a product line.
You need to answer two questions immediately. First, where is this firmware currently distributed? Check your public download portals, customer support repositories, and any partner distribution channels. If the image is accessible, treat the key as compromised — assume adversaries already have it. Second, what devices are running this firmware and can they receive updates? Embedded devices often ship with no update mechanism, meaning the key will remain in production indefinitely on deployed hardware regardless of what patch you release today.
The remediation is not complete when you rotate the key. Rotating addresses today's exposure, but the structural condition that embedded the key statically will produce the next CVE in this class if you don't change the workflow. Firmware build pipelines need secrets injection at build or deploy time — a production key injected from an external source, not compiled into the binary. This requires your build system to support key injection as a first-class operation, same as cloud infrastructure has done for years.
The harder problem is accounting for forgotten firmware versions. The binary you ship today also exists in warehouses, spare parts inventories, and devices that will never receive an OTA update. Those deployments are permanently exposed. You must determine how many legacy firmware versions are in the wild and treat the key compromise as permanent for those deployments — meaning you need defensive architecture (certificate pinning, forward secrecy, detection of key misuse) around any device you cannot update.
Assign ownership of firmware secrets management now. Without a defined role accountable for this pipeline, the gap will persist regardless of awareness.