CVE-2026-3966

Name of the Vulnerable Software and Affected Versions 648540858 wvp-GB28181-pro versions through 2.7.4-20260107

Description A flaw exists in the IP Address Handler component of 648540858 wvp-GB28181-pro. Specifically, the getDownloadFilePath function within the /src/main/java/com/genersoft/iot/vmp/media/abl/ABLMediaNodeServerService.java file is susceptible to server-side request forgery (SSRF). Manipulation of the MediaServer.streamIp argument can trigger this issue, allowing for remote attacks. The exploit is publicly available. The vendor was informed of this issue but did not provide a response.

Recommendations Versions through 2.7.4-20260107: At the moment, there is no information about a newer version that contains a fix for this vulnerability.