CVE-2026-100294
Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 29, 2026
- Updated
- Sep 29, 2026
- Reserved
- Sep 25, 2026
Description
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | icscert |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | icscert |
Weaknesses
- CWE-798 Use of Hard-coded Credentials
Affected Products
| Product | Versions |
|---|---|
YSSD-RTMP-H5Anjvision |
|
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.