CVE-2026-3966 Details
Description
A vulnerability was detected in 648540858 wvp-GB28181-pro up to 2.7.4-20260107. Affected by this vulnerability is the function getDownloadFilePath of the file /src/main/java/com/genersoft/iot/vmp/media/abl/ABLMediaNodeServerService.java of the component IP Address Handler. The manipulation of the argument MediaServer.streamIp results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A server-side request forgery (SSRF) vulnerability has been identified in 648540858 wvp-GB28181-pro versions through 2.7.4-20260107. The issue resides in the ABLMediaNodeServerService component, specifically within the getDownloadFilePath function. This vulnerability allows an attacker with administrative access to inject a malicious IP address into the streamIp parameter of the Media Server configuration. When a user triggers a cloud record download, the application constructs an HTTP URL using the injected IP address and makes an unvalidated HTTP request. This exploitation can lead to scanning internal networks, accessing cloud metadata services (such as AWS IAM credentials), or probing internal services from the application server's perspective.
The vulnerability can be remediated by adding validation for the streamIp parameter to ensure it does not contain private IP addresses, cloud metadata service addresses, or localhost variants before being stored or used in HTTP requests. Additionally, implementing network segmentation to block internal IP requests could enhance security.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 12, 2026CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AnalogyC0de/public_exp/issues/15 | [email protected] | ExploitIssue TrackingTechnical Analysis |
| https://vuldb.com/?ctiid.350395 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/?id.350395 | [email protected] | AdvisoryExploitTechnical Description |
| https://vuldb.com/?submit.768915 | [email protected] | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 648540858 wvp-GB28181-pro | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 12, 2026 | New CVE Received | [email protected] |