CVE-2026-100291 in YSSD-RTMP-H5
Summary
by MITRE • 09/29/2026
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 represents a critical failure in the implementation of access control mechanisms within the Network Video Transmitter's ONVIF service layer. The Open Network Video Interface Forum (ONVIF) standard is widely adopted in the video surveillance industry to ensure interoperability between networked video products from different manufacturers. This standard defines specific web services and endpoints that allow remote management, configuration, and control of devices such as cameras, digital video recorders, and encoders. In this specific firmware version, several of these ONVIF service endpoints are configured or coded in a manner that fails to enforce mandatory authentication checks before processing incoming management requests. This architectural flaw effectively bypasses the security boundary intended by the vendor, allowing any entity with network connectivity to interact with sensitive device functions without providing valid credentials.
From a technical perspective, this vulnerability falls under the category of broken access control, specifically aligning with CWE-306: Missing Authentication for Critical Function. The root cause lies in the application logic governing the ONVIF service handlers. When an HTTP or SOAP request is received targeting these specific endpoints, the server-side processing does not validate the presence or validity of authentication tokens, such as Basic Auth headers or WS-Security signatures, which are required by the ONVIF specification for administrative operations. Consequently, the device treats unauthenticated requests with the same level of trust as authenticated ones from authorized administrators. This lack of enforcement means that any actor capable of reaching the network interface hosting the service can invoke these endpoints directly, exploiting the absence of a gatekeeping mechanism at the application layer.
The operational impact of this vulnerability is severe and multifaceted. An unauthorized attacker who exploits this flaw gains the ability to perform sensitive device operations without detection or restriction. Depending on the specific capabilities exposed by the affected ONVIF endpoints, an attacker could potentially retrieve configuration details that reveal network topology, disable video streaming services, alter recording schedules, modify user accounts including administrative privileges, or even trigger firmware updates if such functionality is exposed through these unauthenticated channels. This level of access compromises the confidentiality, integrity, and availability of the surveillance system. In a physical security context, this could lead to blind spots in monitoring coverage, tampering with evidence retention policies, or complete denial of service by shutting down critical video transmission services.
This vulnerability maps directly to several tactics within the MITRE ATT&CK framework for IoT devices. It aligns with T1078: Valid Accounts, as it allows an attacker to operate under the guise of a valid administrator without possessing actual credentials. Furthermore, if the exposed endpoints allow configuration changes or service manipulation, it relates to T1562: Impair Defenses and T1496: Resource Hijacking. The exploitation typically occurs at Layer 7 (Application) of the OSI model, leveraging standard web protocols which may traverse firewalls that permit HTTP traffic, thereby increasing the attack surface significantly in both local network segments and potentially over the internet if port forwarding is misconfigured.
Mitigation strategies must address this deficiency immediately to restore secure operation. The primary remediation involves applying a firmware update provided by Anjvision that corrects the authentication logic within the ONVIF service endpoints, ensuring all management requests are strictly validated against authorized user credentials before execution. If an immediate patch is unavailable, network-level controls should be implemented as compensating measures. This includes restricting access to the device's management interface using firewall rules or Access Control Lists (ACLs) that limit connectivity to trusted IP addresses only. Additionally, placing the device in a segmented VLAN isolated from general user traffic and public internet exposure can significantly reduce the risk of exploitation. Regular vulnerability scanning and penetration testing should be conducted on all ONVIF-enabled devices to identify similar misconfigurations across the surveillance infrastructure.