CVE-2026-100299

Medium6.8 Published on Sep 29, 2026

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption.

CVSS score6.8 / 10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-1391

Vulnerabilities

Nine Flaws Leave Anjvision Video Devices Exposed Without a Planned Firmware Fix

CISA disclosed nine flaws in Anjvision YSSD-RTMP-H5 firmware, including unauthenticated access and RCE, with CVSS 9.8 and no fix planned.

Sep 30, 202605:10 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Nine Flaws Leave Anjvision Video Devices Exposed Without a Planned Firmware Fix