CVE-2026-100291: Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthorized attacker who can reach the affected device's ONVIF service endpoints can send management requests without the required authentication. The vector is network-based and requires no privileges or user interaction.
Which devices are known to be affected?
The affected product identified in the available information is Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4.
What is the potential impact of successful exploitation?
An attacker may gain access to sensitive device operations through unauthenticated ONVIF management requests. The reported severity indicates potential high impact to confidentiality, integrity, and availability.