Cyber Defense Insights Analysis Desk
The Cybersecurity and Infrastructure Security Agency has warned that nine vulnerabilities in Anjvision YSSD-RTMP-H5 firmware could let attackers access sensitive information, use device accounts, execute operating-system commands, or take full control of affected equipment. The warning covers firmware version 3.3.2.4_build_2024-12-26, and CISA lists the product as used in commercial facilities worldwide. CISA’s advisory assigns the group a vendor-equipment CVSS v3 score of 9.8.
The most severe issue, CVE-2026-100291, affects several ONVIF service endpoints that process management requests without enforcing required authentication. An unauthorized attacker could therefore reach sensitive device operations over the network. CISA rates the flaw critical at 9.8 under CVSS 3.1, with a vector indicating no required privileges, no user interaction, and potential impacts to confidentiality, integrity, and availability.
Two other flaws involve internal debug functionality, but they have different access conditions and severity ratings. CVE-2026-100292 allows a hidden debug interface to be enabled through an authenticated request, exposing additional commands to a backend service. CISA rates that issue high severity at 8.8. A separate issue, CVE-2026-100295, exposes another internal debug interface through an undocumented pathway and can provide actions associated with elevated system access. Its CVSS 3.1 score is 6.3, which CISA classifies as medium.
CVE-2026-100293 affects both local and cloud firmware updates. The update mechanisms use basic hashing but do not perform cryptographic signature verification, allowing an attacker who can reach the update routine to supply an untrusted firmware image that the device accepts as valid. CISA gives this vulnerability a CVSS 3.1 score of 8.8. The advisory does not identify a corrected firmware version.
Other weaknesses expose credentials and account controls. The firmware embeds cloud-API credentials shared across deployed devices, according to the advisory for CVE-2026-100294. Anyone who obtains the public firmware package could reuse those values to interact with the cloud service in ways not intended for normal operation. The flaw is rated high at 7.5 under CVSS 3.1. CVE-2026-100298 separately concerns two user-information endpoints that can reveal sensitive device and account details under conditions not intended for normal operation; CISA rates it 8.8.
The advisory also describes an authenticated password-downgrade path in CVE-2026-100296. An empty-body POST to /setUserConfig, handled through the web server’s SOAP-RPC mechanism, can silently reset the administrator password to its default value and corrupt in-memory authentication state until the device reloads. The handler does not check the session’s privilege level, so any authenticated user can trigger it. CISA assigns the flaw a CVSS 3.1 score of 8.1.
An unauthenticated network-check function creates a server-side request forgery issue in CVE-2026-100297. An attacker can trigger the device to probe arbitrary hosts on its internal network, potentially exposing internal information or leaking data through DNS queries. CISA rates the issue medium severity at 5.3 under CVSS 3.1 and medium at 6.9 under CVSS 4.0.
CISA lists remediation status for the affected vulnerabilities as “No fix planned.” The agency says Anjvision did not respond to requests to work with CISA on mitigation. Users of the affected firmware are directed to contact Anjvision customer support for additional information through the company’s problem-report page. The advisory identifies the affected product as Anjvision YSSD-RTMP-H5 firmware 3.3.2.4_build_2024-12-26; no later fixed version is named in the notice.