EUVD-2026-89368
GHSA-5v8p-59fw-m8g2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable update routine at low complexity, but reaching it needs some access so PR:L; unsigned firmware yields full code control giving C/I/A:H with no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
6DescriptionCVE.org
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the device will accept as valid.
AnalysisAI
Attackers who can reach the firmware update routine of Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can push arbitrary, unverified firmware images to the device and take full control of it, because both the local and the cloud update paths validate only a basic hash instead of a cryptographic signature. The flaw is a design-level chain-of-trust failure (CWE-347) scored 8.7 under CVSS 4.0, and per the associated CVSS vector it requires low-level privileges (PR:L) with no user interaction (UI:N) while impacting confidentiality, integrity and availability equally. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to reach the device's firmware update routine - specifically either the local update path or the cloud update path of Anjvision YSSD-RTMP-H5 firmware 3.3.2.4. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-severity integrity flaw, not a high-CVSS-but-low-real-risk issue, though its practical urgency is bounded by product footprint and access requirements. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so the exact fixed release cannot be cited; obtain vendor guidance from the CISA ICS advisory ICSA-26-272-05 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05), the single reference attached to this CVE, and apply a firmware release only once the vendor states that cryptographic signature verification has been added to both update paths. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Anjvision YSSD-RTMP-H5 devices running firmware 3.3.2.4, isolate them on restricted network segments, and block external access to the firmware update routine and management interfaces; if the cloud update path cannot be disabled, restrict outbound connectivity to known vendor endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a d
Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_12
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows r
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operatin
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows r
Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wirele
Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 wit
Poisoned-pipeline (pwn request) code execution in the Meshtastic firmware repository's GitHub Actions CI allows any exte
Authentication bypass in Tenda router firmware (AC10, AC5, AC6, FH1201, W15E) lets any user log in as administrator via
Anonymous MQTT access in Yarbo firmware v2.3.9 allows remote unauthenticated attackers on the local network to fully con
Hardcoded administrative credentials in Yarbo firmware v2.3.9 allow remote unauthenticated attackers to gain full device
Lantronix G520 Series firmware (2.6.0.4R6 stable, covering G526, G526RP, G527 and G528) can be induced to treat forged s
Share
External POC / Exploit Code
Leaving vuln.today