The vulnerability is an improper protection of credentials that allows two user‑information endpoints to expose device and account details in the Anjvision YSSD‑RTMP‑H5 firmware v3.3.2.4. The flaw is a CWE‑522 vulnerability, leading to disclosure of sensitive device and user data when the endpoints are accessed under non‑intended conditions. If an attacker can reach these endpoints, they could read device identifiers, configuration information, and account credentials, potentially facilitating further exploitation or compromising the integrity of the system.

Anjvision’s YSSD‑RTMP‑H5 device running firmware version 3.3.2.4 is affected. Only this firmware version is mentioned in the CVE. The affected vendor is Anjvision and the product is YSSD‑RTMP‑H5.

This flaw has a CVSS score of 8.7 indicating high severity. EPSS is not available, so no estimate of exploit probability is provided. It is not listed in CISA KEV. The likely attack vector is remote, through network exposed endpoints; exploitation requires network connectivity to the device and the ability to send crafted HTTP requests to the two endpoints. Based on the description, it is inferred that no authentication is required for the endpoints to return information, so any user with network access can exploit the flaw.