EUVD-2026-89367
GHSA-289f-px42-xxg8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable command injection needing valid low-privilege credentials (PR:L) to enable the debug path, no user interaction, yielding full OS-level command execution (C/I/A:H).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if crafted inputs reach the underlying command handler.
AnalysisAI
OS command injection in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows authenticated, low-privileged network attackers to enable a hidden debug interface and then deliver crafted input to a backend command handler, resulting in high impact to confidentiality, integrity, and availability of the device (assessed CVSS:3.1 8.7, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires network reachability to the device's management/control service, valid credentials of at least low privilege, and the specific firmware build; no user interaction is needed, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to the device's management/control service (AV:N), (2) valid authentication credentials of at least low privilege (PR:L) to issue the request that enables the hidden debug interface, and (3) firmware version 3.3.2.4 of the Anjvision YSSD-RTMP-H5. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority-worthy issue for affected deployments, though several corroborating signals are absent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis and the available advisory data does not specify an exact fixed firmware version, so do not assume a specific upgrade target; check CISA ICS Advisory ICSA-26-272-05 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05) for the vendor's current fixed-release guidance and apply it as soon as a version is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Anjvision YSSD-RTMP-H5 devices running firmware 3.3.2.4 and immediately restrict network access to their management interfaces using firewall rules or network segmentation, allowing only trusted administrative hosts; enable detailed logging and monitor for unusual debug interface activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Yssd Rtmp H5
View allUnauthenticated ONVIF service endpoints in Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 fail to enforce authe
Hardcoded, shared cloud-API credentials baked into Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 can be extracted by a
Attackers who can reach the firmware update routine of Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can push arbitrary, unver
Authenticated users with any valid account on Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can silently reset the administrat
Server-side request forgery in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows unauthenticated remote attackers to invoke
Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 leaves an internal debug interface in the production image that can be t
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today