CVE-2026-100298 in YSSD-RTMP-H5
Summary
by MITRE • 09/29/2026
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 represents a critical information disclosure flaw within the web interface of this network video recorder system. The core issue stems from improper access control mechanisms governing specific user-information endpoints, which fail to enforce adequate authentication or authorization checks under certain operational conditions. These endpoints are designed to retrieve detailed account and device metadata but remain accessible without requiring valid administrative credentials when triggered through unintended pathways or edge cases in the request handling logic. This misconfiguration allows any unauthenticated actor with network access to query these interfaces and extract sensitive data that should be strictly protected, undermining the fundamental security principle of least privilege.
From a technical perspective, this flaw aligns closely with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability likely arises from insufficient validation of session tokens or missing checks for user roles when processing requests directed at these specific API endpoints. In many embedded video surveillance systems, such endpoints are intended for internal system diagnostics or administrative management but are inadvertently exposed through the public-facing web server configuration. An attacker can exploit this by crafting specific HTTP requests to enumerate valid usernames, retrieve hashed passwords, obtain device serial numbers, and access other proprietary identifiers. This exposure provides a comprehensive profile of the target environment, facilitating further malicious activities such as credential stuffing attacks or targeted social engineering campaigns against administrators.
The operational impact of this vulnerability is significant for organizations relying on Anjvision YSSD-RTMP-H5 devices for physical security monitoring. The leakage of account details can lead to unauthorized access to live video feeds and recorded footage, resulting in severe privacy violations and potential compliance failures with regulations such as GDPR or HIPAA if sensitive areas are monitored. Furthermore, the disclosure of device-specific information aids attackers in identifying specific firmware versions and hardware configurations, enabling them to search for known exploits tailored to this exact model. This transforms a simple data leak into a precursor for more destructive attacks, including remote code execution or denial-of-service conditions that could disrupt critical security operations.
Mitigation strategies must prioritize immediate remediation of the access control logic governing these endpoints. The vendor should implement strict authentication requirements and role-based access controls to ensure that only authorized administrators can query user information. Additionally, input validation and request filtering mechanisms should be strengthened to prevent exploitation through edge cases in endpoint routing. For organizations unable to immediately apply a firmware patch, network-level mitigations such as restricting web interface access via firewall rules or placing the devices on isolated management VLANs are recommended. Regular security audits of embedded device configurations and continuous monitoring for anomalous API traffic can also help detect potential exploitation attempts before significant damage occurs.