CVE-2026-4860 - Vulnerability Details

- 648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization

Description

A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-03-26

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability lies in the GenericFastJsonRedisSerializer used by the API Endpoint of wvp-GB28181-pro. It deserializes JSON data without proper validation, which can allow an attacker to supply malicious objects. Based on the description that the flaw can be exploited remotely and that an exploit has been released, this flaw is likely capable of enabling arbitrary code execution on the host system.

Affected Systems

The affected product is 648540858 wvp-GB28181-pro, versions up to and including 2.7.4. The specific component impacted is the RedisTemplateConfig.java file in the API Endpoint module. No other vendors, products, or versions are listed as impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity issue. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the flaw can be triggered by sending crafted data to the API Endpoint over the network. Publicly available exploit code suggests that attackers can leverage the flaw without user interaction.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

648540858

wvp-GB28181-pro

affected

Version	Status	Constraints
`2.7.0`	affected	—
`2.7.1`	affected	—
`2.7.2`	affected	—
`2.7.3`	affected	—
`2.7.4`	affected	—

No data.

Vendor Product Confidence Versions

648540858

Wvp-gb28181-pro

100%

Version	Status	Scheme	Platform
`2.7.0`	affected	semver	—
`2.7.1`	affected	semver	—
`2.7.2`	affected	semver	—
`2.7.3`	affected	semver	—
`2.7.4`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply an official patch or upgrade to a version newer than 2.7.4 once the vendor releases it.
If a patch is not available, replace GenericFastJsonRedisSerializer with a more secure serialization method or disable Redis deserialization entirely.
Restrict network exposure of the API Endpoint using firewall rules or network segmentation to limit external access.
Monitor logs for anomalous deserialization activity or unexpected process creation to detect potential exploitation attempts.

Generated by OpenCVE AI on March 26, 2026 at 09:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00043.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/wing3e/public_exp/issues/1
https://vuldb.com/?ctiid.353191
https://vuldb.com/?id.353191
https://vuldb.com/?submit.776213

History

Thu, 26 Mar 2026 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 26 Mar 2026 12:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		648540858 648540858 wvp-gb28181-pro
Vendors & Products		648540858 648540858 wvp-gb28181-pro

Thu, 26 Mar 2026 08:45:00 +0000

Type	Values Removed	Values Added
Description		A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title		648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization
Weaknesses		CWE-20 CWE-502
References		https://github.com/wing3e/public_exp/issues/1 https://vuldb.com/?ctiid.353191 https://vuldb.com/?id.353191 https://vuldb.com/?submit.776213
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

648540858 Wvp-gb28181-pro

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-03-26T08:18:03.574Z

Updated: 2026-03-26T18:25:31.687Z

Reserved: 2026-03-25T16:28:39.937Z

Link: CVE-2026-4860

Vulnrichment

Updated: 2026-03-26T18:22:24.109Z

NVD

Status : Awaiting Analysis

Published: 2026-03-26T09:16:06.497

Modified: 2026-03-30T13:26:50.827

Link: CVE-2026-4860

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-03-26T12:08:13Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object