CISA Warns of Critical Vulnerabilities in Anjvision YSSD-RTMP-H5 Firmware
CISA has issued an advisory detailing multiple critical vulnerabilities in Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, potentially allowing attackers to gain full control of affected devices.
CISA has issued a critical advisory for multiple vulnerabilities affecting Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4. These security flaws, rated with CVSS v3 base scores as high as 9.8, could allow an attacker to access sensitive information, take over user accounts, execute arbitrary operating system commands, or gain complete control over the affected devices.
The advisory highlights several specific vulnerabilities. CVE-2026-100291 involves unauthenticated access to device operations through improperly secured ONVIF service endpoints, enabling unauthorized attackers to manipulate device functions. Another critical flaw, CVE-2026-100292, resides in a debug interface that can be enabled via an authenticated request. Once active, this interface exposes system-level functionality that, if exploited with crafted inputs, could lead to OS command injection.
Further compounding the risk, CVE-2026-100293 points to a lack of cryptographic verification for firmware updates. Both local and cloud update mechanisms rely only on basic hashing, allowing attackers to introduce untrusted firmware images that the device will accept as legitimate. This could pave the way for persistent compromise or the deployment of malicious code.
Additional vulnerabilities include CVE-2026-100294, which involves the use of hard-coded cloud API credentials embedded within the firmware. These shared credentials, if exposed through the public firmware package, can be reused by attackers to interact with the cloud service in unintended ways. CVE-2026-100295, similar to CVE-2026-100292, involves an undocumented pathway to enable an internal debug interface, potentially granting elevated system access.
The affected product is the Anjvision YSSD-RTMP-H5, specifically firmware version 3.3.2.4_build_2024-12-26. These devices are deployed globally across various critical infrastructure sectors, including commercial facilities, making the widespread impact of these vulnerabilities a significant concern.
Compounding the severity of these findings, Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. This lack of vendor response means there is currently no planned fix for the affected firmware. Users are advised to contact Anjvision customer support for additional information, though no direct mitigation or patch is available.
Given the critical nature of the vulnerabilities and the lack of vendor-provided remediation, organizations using Anjvision YSSD-RTMP-H5 devices are urged to implement compensating controls where possible. This could include network segmentation to limit access to these devices, enhanced monitoring for suspicious activity, and considering the replacement of affected hardware if feasible. The advisory underscores the ongoing challenges in securing industrial control systems and IoT devices, particularly when vendor support is lacking.
The vulnerabilities span multiple CWE categories, including Initialization of a Resource with an Insecure Default, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Verification of Cryptographic Signature, Use of Hard-coded Credentials, Active Debug Code, Improper Check for Unusual or Exceptional Conditions, Server-Side Request Forgery (SSRF), Insufficiently Protected Credentials, and Use of Weak Credentials. The combination of these flaws presents a severe risk to the security and operational integrity of affected Anjvision devices.