CVE-2026-3966: SSRF in wvp-GB28181-pro

The SSRF vulnerability in wvp-GB28181-pro allows an attacker to craft malicious requests that originate from the server itself. This can be exploited to access internal resources that are not directly accessible from the outside world. For example, an attacker could potentially scan the internal network for open ports, access internal APIs, or even read sensitive configuration files. The ability to manipulate the streamIp argument directly contributes to the ease of exploitation. Given the public availability of an exploit, the risk of immediate exploitation is high.

1. Reserved2026-03-11
2. Published2026-03-12
3. EPSS updated2026-03-23

Due to the vendor's lack of response, immediate mitigation options are limited. As a temporary workaround, implement strict input validation on the streamIp parameter, restricting allowed values to a whitelist of trusted IP addresses or domains. Consider deploying a Web Application Firewall (WAF) with rules to block suspicious outbound requests. Monitor network traffic for unusual outbound connections originating from the wvp-GB28181-pro server. After upgrading to a patched version (when available), confirm the fix by attempting to trigger the SSRF vulnerability with a known malicious payload; it should be blocked.