CVE-2024-37665 is an access control vulnerability identified in Wvp GB28181 Pro 2.0, a software product implementing the GB28181 standard commonly used for video surveillance and security systems. The vulnerability allows an attacker who has already authenticated with the system to escalate their privileges to Administrator by sending a crafted POST request. This indicates a failure in proper authorization checks within the application, specifically an improper privilege management issue (CWE-269). The CVSS v3.1 base score is 8.8, reflecting a high severity due to the network attack vector (AV:N), low attack complexity (AC:L), and the requirement of privileges (PR:L) but no user interaction (UI:N). The impact includes full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), meaning an attacker can potentially access sensitive information, alter configurations, or disrupt system operations. The vulnerability affects all versions of Wvp GB28181 Pro 2.0, though specific affected versions are not detailed. No patches or fixes have been released at the time of publication, and there are no known exploits in the wild, but the risk remains significant given the nature of the flaw and the critical role of the affected software in security infrastructure.

The vulnerability allows attackers with authenticated access to gain full administrative privileges, which can lead to complete system compromise. This includes unauthorized access to sensitive surveillance data, manipulation or deletion of video feeds, disruption of security monitoring services, and potential pivoting to other network segments. Organizations relying on Wvp GB28181 Pro 2.0 for video surveillance and security management could face severe operational disruptions, data breaches, and loss of trust. The high severity and ease of exploitation (low complexity, no user interaction) increase the risk of targeted attacks, especially in environments where multiple users have authenticated access with limited privileges. The absence of patches elevates the urgency for organizations to implement compensating controls to mitigate risk.

1. Immediately review and restrict authenticated user privileges to the minimum necessary to reduce the attack surface. 2. Implement network segmentation and access controls to limit access to the Wvp GB28181 Pro 2.0 management interfaces only to trusted administrators and systems. 3. Monitor logs and network traffic for unusual POST requests or privilege escalation attempts targeting the application. 4. Employ Web Application Firewalls (WAFs) with custom rules to detect and block suspicious crafted POST requests that may exploit this vulnerability. 5. Engage with the vendor or community to obtain patches or updates as soon as they become available. 6. Conduct regular security assessments and penetration testing focused on access control mechanisms within the application. 7. Educate users with authenticated access about the risks and encourage strong authentication practices to prevent credential compromise.