CVE-2026-100291

Name of the Vulnerable Software and Affected Versions Anjvision YSSD-RTMP-H5 version 3.3.2.4

Description Several ONVIF service endpoints process management requests without enforcing required authentication. This issue stems from the initialization of a resource with an insecure default, which could allow an unauthorized attacker to access sensitive device operations. This flaw can be chained with other vulnerabilities to achieve complete device compromise, including privilege escalation, lateral movement through Server-Side Request Forgery (SSRF), and firmware manipulation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.