Embedded Credentials Vulnerability in Anjvision YSSD‑RTMP‑H5 Firmware
CVE-2026-100294

8.7HIGH

Key Information:

Vendor

Anjvision

Status
Yssd-rtmp-h5
Vendor
CVE Published:
29 September 2026

What is CVE-2026-100294?

Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4 contains a security issue where hardcoded cloud-API credentials are embedded in the firmware. These credentials are reused across all deployed devices, allowing unauthorized access to the cloud service. Users who can access the public firmware package can exploit this vulnerability to interact with cloud services in unintended ways, posing a significant security risk to device integrity and user data.

Affected Version(s)

YSSD-RTMP-H5 Version 3.3.2.4 build 2024-12-26

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
government-resource

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrew Lee reported these vulnerabilities to CISA.
.