CVE-2026-4860CWE-20CWE-502

648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization

Medium · published March 26, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00538 · 44.5th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2026-03-26T08:18Z
EPSS history
Timeline
  • 26 MAR 08:18Z
    648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization
    cvelistv5