CVE-2026-100291

Summary

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.

Affected Software

VendorProductVersion RangeStatus
AnjvisionYSSD-RTMP-H5Version 3.3.2.4 build 2024-12-26affected

Weaknesses

  • CWE-1188: CWE-1188 Initialization of a resource with an insecure default

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References