The vulnerability is a server‑side request forgery that allows an unauthenticated attacker to trigger a device function that probes arbitrary hosts on the internal network. This can expose internal network information or leak data through DNS queries, potentially revealing sensitive network topology or configuration details.

Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4 is affected. The vulnerability is present only in that firmware release for the YSSD‑RTMP‑H5 product.

The CVSS score of 6.9 indicates a medium severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a moderate risk of exploitation. Because the SSRF can be triggered without authentication and targets internal hosts, an attacker on the same network could gather internal information, though this may require knowledge of internal IP space. The lack of a known public exploit reduces immediate threat, but the information disclosure potential warrants attention.