CVE-2026-100294: Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5
Published Sep 29, 2026
·Updated
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation.
Affected Software
1 affected component
Anjvision YSSD-RTMP-H5=3.3.2.4
Event History
Sep 29, 2026
CVE Published
via MITRE·07:40 PM
Data Sourced
via MITRE·07:40 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs to obtain the public firmware package containing the embedded cloud-API credentials. No access to an individual deployed device is described as necessary.
2
Are the credentials unique to each device?
No. The embedded cloud-API credentials are shared across deployed devices, so credentials recovered from the firmware can be reused against the cloud service.
3
Which firmware version is identified as affected?
The reported affected version is Anjvision YSSD-RTMP-H5 firmware 3.3.2.4.