A vulnerability described as critical has been identified in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function
GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization.
This vulnerability is known as CVE-2026-4860. It is possible to launch the attack remotely. Furthermore, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
