CVE-2026-4860

648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization

State: Published
Severity: 6.9 Medium
Published: Mar 26, 2026
Updated: Mar 26, 2026
Reserved: Mar 25, 2026

Description

A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-502 Deserialization
CWE-20 Improper Input Validation

Affected Products

Product	Versions
wvp-GB28181-pro648540858	2.7.0Affected 2.7.1Affected 2.7.2Affected 2.7.3Affected 2.7.4Affected

References

VDB-353191 | 648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserializationvdb-entrytechnical-description
VDB-353191 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #776213 | WVP PRO wvp-GB28181-pro 2.7.4 Deserializationthird-party-advisory
https://github.com/wing3e/public_exp/issues/1exploitissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.