CVE-2026-100297: Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5
Published Sep 29, 2026
·Updated
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries.
Affected Software
1 affected component
Anjvision YSSD-RTMP-H5=3.3.2.4
Event History
Sep 29, 2026
CVE Published
via MITRE·07:48 PM
Data Sourced
via MITRE·07:48 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The affected network check function is unauthenticated and can be triggered remotely over the network. No privileges or user interaction are required.
2
What systems are at risk from exploitation?
An attacker can use the affected device to probe arbitrary hosts reachable from the device's internal network. This can expose internal-network information and may leak data through DNS queries.
3
Which firmware version is identified as affected?
The issue is reported in Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4.