[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fehjwd2rFHkvXdNEmycbRBXmFSwQeFE4Eaw5ngtAEYiQ":3},{"article":4,"iocs":40,"watch_terms":61,"solutions":62,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"ee4a8498-e70a-47fc-a083-f17ca1bc1b3a","Anjvision YSSD-RTMP-H5","anjvision-yssd-rtmp-h5-fbfa52","View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device. The following versions of Anjvision YSSD-RTMP-H5 are affected: YSSD-RTMP-H5 firmware 3.3.2.4_build_2024-12-26 (CVE-2026-100291, CVE-2026-100292, CVE-2026-100293, CVE-2026-100294, CVE-2026-100295, CVE-2026-100296, CVE-2026-100297, CVE-2026-100298, CVE-2026-100299) CVSS Vendor Equipment Vulnerabilities v3 9.8 Anjvision Anjvision YSSD-RTMP-H5 Initialization of a Resource with an Insecure Default, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Verification of Cryptographic Signature, Use of Hard-coded Credentials, Active Debug Code, Improper Check for Unusual or Exceptional Conditions, Server-Side Request Forgery (SSRF), Insufficiently Protected Credentials, Use of Weak Credentials Background Critical Infrastructure Sectors: Commercial Facilities Countries\u002FAreas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-100291 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations. View CVE Details Affected Products Anjvision YSSD-RTMP-H5 Vendor: Anjvision Product Version: Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status: known_affected Remediations No fix planned Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http:\u002F\u002Fwww.anjvision.com\u002Fproblem\u002Flist-129-cn.html . Relevant CWE: CWE-1188 Initialization of a Resource with an Insecure Default Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H 4.0 9.3 CRITICAL CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N CVE-2026-100292 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if crafted inputs reach the underlying command handler. View CVE Details Affected Products Anjvision YSSD-RTMP-H5 Vendor: Anjvision Product Version: Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status: known_affected Remediations No fix planned Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http:\u002F\u002Fwww.anjvision.com\u002Fproblem\u002Flist-129-cn.html . Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H 4.0 8.7 HIGH CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N CVE-2026-100293 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the device will accept as valid. View CVE Details Affected Products Anjvision YSSD-RTMP-H5 Vendor: Anjvision Product Version: Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status: known_affected Remediations No fix planned Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http:\u002F\u002Fwww.anjvision.com\u002Fproblem\u002Flist-129-cn.html . Relevant CWE: CWE-347 Improper Verification of Cryptographic Signature Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H 4.0 8.7 HIGH CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N CVE-2026-100294 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation. View CVE Details Affected Products Anjvision YSSD-RTMP-H5 Vendor: Anjvision Product Version: Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status: known_affected Remediations No fix planned Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http:\u002F\u002Fwww.anjvision.com\u002Fproblem\u002Flist-129-cn.html . Relevant CWE: CWE-798 Use of Hard-coded Credentials Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N 4.0 8.7 HIGH CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N CVE-2026-100295 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal operation. When activated, this interface allows actions that could unintentionally provide elevated system access. View CVE Details Affected Products Anjvision YSSD-RTMP-H5 Vendor: Anjvision Product Version: Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status: known_affected Remediations No fix planned Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http:\u002F\u002Fwww.anjvision.com\u002Fproblem\u002Flist-129-cn.html. Relevant CWE: CWE-489 Active Debug Code Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.3 MEDIUM CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L 4.0 7.1 HIGH CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N CVE-2026-100296 In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to \u002FsetUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler does not verify the session's privilege level, so any authenticated user can trigger it. View CVE Details Affected Products Anjvision YSSD-RTMP-H5 Vendor: Anjvision Product Version: Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status: known_affected Remediations No fix planned Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http:\u002F\u002Fwww.anjvision.com\u002Fproblem\u002Flist-129-cn.html. Relevant CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H 4.0 7.2 HIGH CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N CVE-2026-100297 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device's internal network. This may expose internal information or leak data via DNS queries. View CVE Details Affected Products Anjvision YSSD-RTMP-H5 Vendor: Anjvision Product Version: Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status: known_affected Remediations No fix planned Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http:\u002F\u002Fwww.anjvision.com\u002Fproblem\u002Flist-129-cn.html. Relevant CWE: CWE-918 Server-Side Request Forgery (SSRF) Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N 4.0 6.9 MEDIUM CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N CVE-2026-100298 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation. View CVE Details Affected Products Anjvision YSSD-RTMP-H5 Vendor: Anjvision Product Version: Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status: known_affected Remediations No fix planned Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http:\u002F\u002Fwww.anjvision.com\u002Fproblem\u002Flist-129-cn.html. Relevant CWE: CWE-522 Insufficiently Protected Credentials Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H 4.0 8.7 HIGH CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N CVE-2026-100299 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption. View CVE Details Affected Products Anjvision YSSD-RTMP-H5 Vendor: Anjvision Product Version: Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status: known_affected Remediations No fix planned Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http:\u002F\u002Fwww.anjvision.com\u002Fproblem\u002Flist-129-cn.html. Relevant CWE: CWE-1391 Use of Weak Credentials Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.8 MEDIUM CVSS:3.1\u002FAV:P\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H 4.0 7 HIGH CVSS:4.0\u002FAV:P\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N Acknowledgments Andrew Lee reported these vulnerabilities to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification (https:\u002F\u002Fwww.cisa.gov\u002Fnotification) and this Privacy & Use policy (https:\u002F\u002Fwww.cisa.gov\u002Fprivacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and\u002For systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov\u002Fics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional no_fix_planned guidance and recommended practices are publicly available on the ICS webpage at cisa.gov\u002Fics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and no_fix_planned Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2026-09-29 Date Revision Summary 2026-09-29 1 Initial Publication Legal Notice and Terms of Use","Multiple critical vulnerabilities have been discovered in Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4. These flaws could allow attackers to access sensitive information, user accounts, execute OS commands, or gain full device control. Anjvision has not planned a fix and has not responded to CISA's requests for mitigation.","Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 has multiple critical vulnerabilities.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-272-05",null,"2026-09-29T12:00:00+00:00","2026-09-29T18:00:22.768735+00:00",8,[17,20],{"name":18,"type":19},"YSSD-RTMP-H5","product",{"name":21,"type":22},"Anjvision","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":12,"name":25,"slug":26},"Vulnerabilities","vulnerabilities",[28,30,35],{"category":29},{"id":23,"icon":12,"name":25,"slug":26},{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[41,45,47,49,51,53,55,57,59],{"type":42,"value":43,"context":44},"cve","CVE-2026-100291","Anjvision YSSD-RTMP-H5 firmware 3.3.2.4",{"type":42,"value":46,"context":44},"CVE-2026-100292",{"type":42,"value":48,"context":44},"CVE-2026-100293",{"type":42,"value":50,"context":44},"CVE-2026-100294",{"type":42,"value":52,"context":44},"CVE-2026-100295",{"type":42,"value":54,"context":44},"CVE-2026-100296",{"type":42,"value":56,"context":44},"CVE-2026-100297",{"type":42,"value":58,"context":44},"CVE-2026-100298",{"type":42,"value":60,"context":44},"CVE-2026-100299",[21,18],{"controls":63,"vendors":151},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":94,"name":95,"problem":96,"products":97},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":123,"name":124,"problem":125,"products":126},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":167},"unpatched-anjvision-camera-firmware-leaves-devices-fully-exposed","Unpatched Anjvision Camera Firmware Leaves Devices Fully Exposed","Multiple critical vulnerabilities in Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 expose devices to OS command injection, unauthorized account access, and full device takeover — with no vendor fix planned or even acknowledged. This situation exemplifies the danger of deploying IoT\u002Fsurveillance hardware from vendors who do not maintain a responsible vulnerability disclosure and remediation program. Because Anjvision has ignored CISA outreach, organizations relying on these devices are indefinitely exposed with no vendor-side relief. This matters broadly because internet-connected cameras and streaming devices are frequent pivot points for attackers seeking deeper network access, making unpatched firmware a systemic risk beyond the device itself.",[157,158,159,160,161,162,163,164,165,166],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-82: Guide to ICS Security","NIST CSF ID.AM-1: Physical devices inventoried","NIST CSF RS.MI-3: Newly identified vulnerabilities mitigated","NIST IR 8259: IoT Device Cybersecurity Baseline","IEC 62443-2-1: Security management system for IACS","CISA ICS Advisory ICSA guidance on unsupported devices","GDPR Article 32: Security of processing (where device data includes personal footage)",{}]