PT-2026-24897 · 648540858 · Wvp Gb28181 Pro

Ana10Gy + 1 · Published 2026-03-12 · Updated 2026-03-12 · CVE-2026-3966

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 648540858 wvp-GB28181-pro versions through 2.7.4-20260107

Description A flaw exists in the IP Address Handler component of 648540858 wvp-GB28181-pro. Specifically, the getDownloadFilePath function within the /src/main/java/com/genersoft/iot/vmp/media/abl/ABLMediaNodeServerService.java file is susceptible to server-side request forgery (SSRF). Manipulation of the MediaServer.streamIp argument can trigger this issue, allowing for remote attacks. The exploit is publicly available. The vendor was informed of this issue but did not provide a response.

Recommendations Versions through 2.7.4-20260107: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-3966

Affected Products

Wvp Gb28181 Pro

References · 8

• 🔥 https://github.com/AnalogyC0de/public_exp/issues/15 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3966 · Security Note
• https://vuldb.com/?id.350395 · Note
• https://twitter.com/CVEnew/status/2031992356413849896 · Twitter Post
• https://vuldb.com/?submit.768915 · Note
• https://t.me/CVEtracker/47204 · Telegram Post
• https://vuldb.com/?ctiid.350395 · Note
• https://t.me/cveNotify/155204 · Telegram Post