CVE-2026-100291
Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5
- State
- Published
- Severity
- 9.3 Critical
- Published
- Sep 29, 2026
- Updated
- Sep 29, 2026
- Reserved
- Sep 25, 2026
Description
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | icscert |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | icscert |
Weaknesses
- CWE-1188 Initialization of a resource with an insecure default
Affected Products
| Product | Versions |
|---|---|
YSSD-RTMP-H5Anjvision |
|
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.