CVE-2026-100298: Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5
Published Sep 29, 2026
·Updated
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation.
Affected Software
1 affected component
Anjvision YSSD-RTMP-H5=3.3.2.4
Event History
Sep 29, 2026
CVE Published
via MITRE·07:50 PM
Data Sourced
via MITRE·07:50 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. An attacker would need some level of authenticated access before using the affected endpoints.
2
Which firmware version is identified as affected?
The reported affected version is Anjvision YSSD-RTMP-H5 firmware 3.3.2.4. No information is provided about other affected or fixed versions.
3
What is the potential impact if the endpoints are exposed?
The endpoints may disclose sensitive device and account details. The assigned CVSS metrics rate confidentiality, integrity, and availability impact as high.