Description
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation.
Published: 2026-09-29
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Cloud Interaction
Action: Contact Vendor
AI Analysis

Impact

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hard‑coded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation. This credential exposure allows an attacker to access cloud resources, potentially modify data, trigger services, or otherwise abuse the service, compromising confidentiality, integrity, and availability of the cloud platform.

Affected Systems

Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4 is affected. The vulnerability is present in devices running this specific firmware build.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity. Because the credentials are embedded in the firmware, an attacker must obtain the public firmware package, which is often publicly available, to exploit this weakness. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector involves downloading the firmware image, extracting the credentials, and then using those credentials to interact with the cloud service outside intended usage.

Generated by OpenCVE AI on September 29, 2026 at 21:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Contact Anjvision to obtain a firmware update that removes hard‑coded credentials or applies a secure credential management approach.
  • If a new firmware is not immediately available, restrict access to the firmware download and limit distribution to trusted personnel to prevent unauthorized acquisition of the credentials.
  • Monitor cloud service access logs for anomalous activity using the shared credentials and rotate or revoke the credentials if they have been exposed or misused.

Generated by OpenCVE AI on September 29, 2026 at 21:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Anjvision
Anjvision yssd-rtmp-h5
Vendors & Products Anjvision
Anjvision yssd-rtmp-h5

Tue, 29 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation.
Title Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5
Weaknesses CWE-798
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Anjvision Yssd-rtmp-h5
cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-09-29T21:01:59.107Z

Reserved: 2026-09-25T17:42:35.995Z

Link: CVE-2026-100294

cve-icon Vulnrichment

Updated: 2026-09-29T21:00:04.438Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T20:17:09.787

Modified: 2026-09-29T22:17:05.900

Link: CVE-2026-100294

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T20:36:07Z

Weaknesses
  • CWE-798

    Use of Hard-coded Credentials