The flaw allows an attacker who can reach the update routine to install firmware images without proper cryptographic signature verification, relying only on basic hashing. This bypass enables the device to load and execute malicious firmware, potentially granting the attacker full control over the system. The weakness is classified as CWE-347, improper validation of a cryptographic signature.

Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 is affected. No other vendors, products or versions are listed as impacted.

The CVSS score of 8.7 indicates high severity. With no EPSS data and not listed in CISA KEV, the exact likelihood of exploitation is uncertain, but the vulnerability permits remote code execution if the attacker can reach the update path. It is inferred that the attack vector is network based, as the update mechanism is accessed remotely or locally.