CVE-2026-100297
Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 29, 2026
- Updated
- Sep 29, 2026
- Reserved
- Sep 25, 2026
Description
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | icscert |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | icscert |
Weaknesses
- CWE-918 Server-Side request forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
YSSD-RTMP-H5Anjvision |
|
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.