CVE-2026-100298

Deferred Deferred - Pending Action

Information Disclosure in Anjvision YSSD-RTMP-H5 Firmware

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: ICS-CERT

Description

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100298

EUVD

EUVD-2026-89407

Affected Vendors & Products

Vendor	Product	Version / Range
anjvision	yssd-rtmp-h5	3.3.2.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, two user-information endpoints expose sensitive device and account details under unintended operational conditions. This means the system may leak confidential information without proper authentication or normal usage scenarios.

Detection Guidance

This vulnerability involves exposed user-information endpoints in Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4. To detect it, inspect network traffic for requests to endpoints that may expose sensitive device or account details. Check for unusual GET requests to paths like /user-info or similar endpoints. Use tools like curl to probe endpoints: curl -v http://<device-ip>/user-info. Monitor logs for unauthorized access attempts or unusual data retrieval patterns.

Impact Analysis

Attackers could exploit this to access private device data or user account information, leading to privacy breaches, unauthorized access, or potential misuse of sensitive details. The high CVSS scores indicate significant risk of confidentiality and integrity compromise.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized exposure of personal and health-related data. Organizations using this firmware may face compliance violations, legal penalties, and reputational damage from data leaks.

Mitigation Strategies

Immediately update the Anjvision YSSD-RTMP-H5 firmware to the latest version to address the exposed endpoints. Restrict network access to the device's web interface and disable unnecessary services. Monitor network traffic for unusual requests to the affected endpoints.

Hi! I’m here to help you understand CVE-2026-100298. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70