CVE-2026-100291 in YSSD-RTMP-H5

Resumen

por MITRE • 2026-09-29

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsable: Icscert
• Reservar: 2026-09-25
• Divulgación: 2026-09-29
• Moderación: aceptado
• Artículo: VDB-411763
• CPE: listo
• CWE: CWE-306 (confirmado)
• CVSS: 9.8 (CNA)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-100291
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100291
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-100291/