CVE-2026-100295

Deferred Deferred - Pending Action

Debug Interface Bypass in Anjvision YSSD-RTMP-H5 Firmware

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: ICS-CERT

Description

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal operation. When activated, this interface allows actions that could unintentionally provide elevated system access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100295

EUVD

EUVD-2026-89372

Affected Vendors & Products

Vendor	Product	Version / Range
anjvision	yssd-rtmp-h5	3.3.2.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-489	The product is released with debugging code still enabled or active.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4. An internal debug interface can be enabled through an undocumented method, exposing functions not meant for normal use. When activated, this interface may allow actions that unintentionally grant elevated system access.

Detection Guidance

Detection involves checking for the presence of an enabled internal debug interface on Anjvision YSSD-RTMP-H5 devices running firmware version 3.3.2.4. Monitor network traffic for unusual connections to debug ports or interfaces. Inspect system logs for unauthorized access attempts or elevated privilege activities.

Impact Analysis

An attacker could exploit this to gain elevated system access, potentially leading to unauthorized control or manipulation of the affected device. This could result in data breaches, system disruptions, or further compromise of connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update the firmware to the latest version to disable the debug interface. Disable any undocumented or unnecessary network services. Restrict network access to the device using firewalls or network segmentation. Review and audit user privileges to ensure least privilege access.

Hi! I’m here to help you understand CVE-2026-100295. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70