CVE-2026-100291

Critical9.8Published on September 29, 2026

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-1188

Vulnerabilities

Nine Flaws Leave Anjvision Video Devices Exposed Without a Planned Firmware Fix

CISA disclosed nine flaws in Anjvision YSSD-RTMP-H5 firmware, including unauthenticated access and RCE, with CVSS 9.8 and no fix planned.

Sep 30, 202605:105 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Nine Flaws Leave Anjvision Video Devices Exposed Without a Planned Firmware Fix