CVE-2026-100291: CWE-1188 Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.
AI Analysis
Technical Summary
CVE-2026-100291 affects Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4. Several ONVIF service endpoints process management requests without enforcing required authentication, enabling unauthorized access to sensitive device operations. This vulnerability is classified under CWE-1188, which involves initialization of a resource with an insecure default. The CVSS 3.1 score of 9.8 indicates a critical impact on confidentiality, integrity, and availability, with an attacker able to exploit remotely without privileges or user interaction.
Potential Impact
Unauthorized attackers can remotely access and potentially control sensitive management functions of the affected device due to missing authentication enforcement on ONVIF service endpoints. This compromises confidentiality, integrity, and availability of the device, posing a critical security risk.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict network access to the device's management interfaces and monitor for unauthorized access attempts.
CVE-2026-100291: CWE-1188 Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5
Description
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.
CVSS v3.1
Score 9.8critical
Affected software
Anjvision
YSSD-RTMP-H5
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-100291 affects Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4. Several ONVIF service endpoints process management requests without enforcing required authentication, enabling unauthorized access to sensitive device operations. This vulnerability is classified under CWE-1188, which involves initialization of a resource with an insecure default. The CVSS 3.1 score of 9.8 indicates a critical impact on confidentiality, integrity, and availability, with an attacker able to exploit remotely without privileges or user interaction.
Potential Impact
Unauthorized attackers can remotely access and potentially control sensitive management functions of the affected device due to missing authentication enforcement on ONVIF service endpoints. This compromises confidentiality, integrity, and availability of the device, posing a critical security risk.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict network access to the device's management interfaces and monitor for unauthorized access attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- icscert
- Date Reserved
- 2026-09-25T17:42:35.994Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abc16dc680226ef683368bf
Added to database: 09/29/2026, 19:51:56 UTC
Last enriched: 09/29/2026, 20:06:24 UTC
Last updated: 09/29/2026, 20:53:51 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.