1. Forum
  2. TCOB1
  3. CISA Advisories

  • Anjvision YSSD-RTMP-H5

    From Cisa Advisories@2:263/1 to All on Tue Sep 29 17:33:06 2026
    Anjvision YSSD-RTMP-H5

    View CSAF
    Summary
    Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device. The following versions of Anjvision YSSD-RTMP-H5 are affected:

    YSSD-RTMP-H5 firmware 3.3.2.4_build_2024-12-26 (CVE-2026-100291, CVE-2026-100292, CVE-2026-100293, CVE-2026-100294, CVE-2026-100295, CVE-2026-100296, CVE-2026-100297, CVE-2026-100298, CVE-2026-100299)





    CVSS
    Vendor
    Equipment
    Vulnerabilities




    v3 9.8
    Anjvision
    Anjvision YSSD-RTMP-H5
    Initialization of a Resource with an Insecure Default, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Verification of Cryptographic Signature, Use of Hard-coded Credentials, Active Debug Code, Improper Check for Unusual or Exceptional Conditions, Server-Side Request Forgery (SSRF), Insufficiently Protected Credentials, Use of Weak Credentials




    Background

    Critical Infrastructure Sectors: Commercial Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: China


    Vulnerabilities

    Expand All +

    CVE-2026-100291

    In Anjvision YSSD?RTMP?H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.
    View CVE Details

    Affected Products
    Anjvision YSSD-RTMP-H5

    Vendor:Anjvision
    Product Version:Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status:known_affected


    Remediations
    No fix plannedAnjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http://www.anjvision.com/problem/list-129-cn.html .

    Relevant CWE: CWE-1188 Initialization of a Resource with an Insecure Default

    Metrics




    CVSS Version
    Base Score
    Base Severity
    Vector String




    3.1
    9.8
    CRITICAL
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H


    4.0
    9.3
    CRITICAL
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N







    CVE-2026-100292

    In Anjvision YSSD?RTMP?H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system?level functionality that could be misused if crafted inputs reach the underlying command handler.
    View CVE Details

    Affected Products
    Anjvision YSSD-RTMP-H5

    Vendor:Anjvision
    Product Version:Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status:known_affected


    Remediations
    No fix plannedAnjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http://www.anjvision.com/problem/list-129-cn.html .

    Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    Metrics




    CVSS Version
    Base Score
    Base Severity
    Vector String




    3.1
    8.8
    HIGH
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H


    4.0
    8.7
    HIGH
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N







    CVE-2026-100293

    In Anjvision YSSD?RTMP?H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the device will accept as valid.
    View CVE Details

    Affected Products
    Anjvision YSSD-RTMP-H5

    Vendor:Anjvision
    Product Version:Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status:known_affected


    Remediations
    No fix plannedAnjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http://www.anjvision.com/problem/list-129-cn.html .

    Relevant CWE: CWE-347 Improper Verification of Cryptographic Signature

    Metrics




    CVSS Version
    Base Score
    Base Severity
    Vector String




    3.1
    8.8
    HIGH
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H


    4.0
    8.7
    HIGH
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N







    CVE-2026-100294

    In Anjvision YSSD?RTMP?H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud?API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation. View CVE Details

    Affected Products
    Anjvision YSSD-RTMP-H5

    Vendor:Anjvision
    Product Version:Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status:known_affected


    Remediations
    No fix plannedAnjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http://www.anjvision.com/problem/list-129-cn.html .

    Relevant CWE: CWE-798 Use of Hard-coded Credentials

    Metrics




    CVSS Version
    Base Score
    Base Severity
    Vector String




    3.1
    7.5
    HIGH
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N


    4.0
    8.7
    HIGH
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N







    CVE-2026-100295

    In Anjvision YSSD?RTMP?H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal operation. When activated, this interface allows actions that could unintentionally provide elevated system access. View CVE Details

    Affected Products
    Anjvision YSSD-RTMP-H5

    Vendor:Anjvision
    Product Version:Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status:known_affected


    Remediations
    No fix plannedAnjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http://www.anjvision.com/problem/list-129-cn.html.

    Relevant CWE: CWE-489 Active Debug Code

    Metrics




    CVSS Version
    Base Score
    Base Severity
    Vector String




    3.1
    6.3
    MEDIUM
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L


    4.0
    7.1
    HIGH
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N







    CVE-2026-100296

    In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler does not verify the session's privilege level, so any authenticated user can trigger it. View CVE Details

    Affected Products
    Anjvision YSSD-RTMP-H5

    Vendor:Anjvision
    Product Version:Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status:known_affected


    Remediations
    No fix plannedAnjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http://www.anjvision.com/problem/list-129-cn.html.

    Relevant CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions

    Metrics




    CVSS Version
    Base Score
    Base Severity
    Vector String




    3.1
    8.1
    HIGH
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H


    4.0
    7.2
    HIGH
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N







    CVE-2026-100297

    In Anjvision YSSD?RTMP?H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device's internal network. This may expose internal information or leak data via DNS queries.
    View CVE Details

    Affected Products
    Anjvision YSSD-RTMP-H5

    Vendor:Anjvision
    Product Version:Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status:known_affected


    Remediations
    No fix plannedAnjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http://www.anjvision.com/problem/list-129-cn.html.

    Relevant CWE: CWE-918 Server-Side Request Forgery (SSRF)

    Metrics




    CVSS Version
    Base Score
    Base Severity
    Vector String




    3.1
    5.3
    MEDIUM
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N


    4.0
    6.9
    MEDIUM
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N







    CVE-2026-100298

    In Anjvision YSSD?RTMP?H5 firmware version 3.3.2.4, two user?information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation. View CVE Details

    Affected Products
    Anjvision YSSD-RTMP-H5

    Vendor:Anjvision
    Product Version:Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status:known_affected


    Remediations
    No fix plannedAnjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http://www.anjvision.com/problem/list-129-cn.html.

    Relevant CWE: CWE-522 Insufficiently Protected Credentials

    Metrics




    CVSS Version
    Base Score
    Base Severity
    Vector String




    3.1
    8.8
    HIGH
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H


    4.0
    8.7
    HIGH
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N







    CVE-2026-100299

    In Anjvision YSSD?RTMP?H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES?based encryption.
    View CVE Details

    Affected Products
    Anjvision YSSD-RTMP-H5

    Vendor:Anjvision
    Product Version:Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status:known_affected


    Remediations
    No fix plannedAnjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http://www.anjvision.com/problem/list-129-cn.html.

    Relevant CWE: CWE-1391 Use of Weak Credentials

    Metrics




    CVSS Version
    Base Score
    Base Severity
    Vector String




    3.1
    6.8
    MEDIUM
    CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H


    4.0
    7
    HIGH
    CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N








    Acknowledgments

    Andrew Lee reported these vulnerabilities to CISA.


    Legal Notice and Terms of Use
    This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

    Recommended Practices
    CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

    Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

    CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices
    on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
    CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional no_fix_planned guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and no_fix_planned Strategies.
    Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
    CISA also recommends users take the following measures to protect themselves from social engineering attacks:

    Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
    Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

    No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

    Revision History

    Initial Release Date: 2026-09-29




    Date
    Revision
    Summary




    2026-09-29
    1
    Initial Publication




    Legal Notice and Terms of Use

    https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05

    2026-09-29 12:00 UTC

    --- BBBS/LiR v4.10 Toy-7
    * Origin: LISTS. from TCOB1 READ ONLY (2:263/1)