EUVD-2026-89369
GHSA-qrp7-9p7c-77mg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Credentials are extractable from public firmware and replayed remotely without auth (AV:N/AC:L/PR:N), yielding unauthorized confidential cloud interaction (C:H) with no stated integrity/availability impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation.
AnalysisAI
Hardcoded, shared cloud-API credentials baked into Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 can be extracted by anyone who obtains the publicly distributed firmware package and then reused against the vendor's cloud service in ways outside normal device operation, exposing data the cloud API is meant to protect. The issue is exploitable remotely with no authentication or user interaction (CVSS 4.0 8.7: AV:N/AC:L/AT:N/PR:N/UI:N, VC:H with VI:N/VA:N; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), limited primarily by the attacker's ability to reach the cloud endpoint and by the credentials remaining valid and unrotated. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the attacker obtain the publicly distributed YSSD-RTMP-H5 firmware version 3.3.2.4 and extract the embedded shared cloud-API credentials, then send requests to the vendor's cloud API endpoint over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 is driven entirely by high confidentiality impact (VC:H) with a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/AT:N/PR:N/UI:N) and no integrity or availability impact (VI:N/VA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the coordinated advisory ICSA-26-272-05 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05) is the place to check for an Anjvision firmware fix and for confirmation of any credential rotation guidance, and operators should press the vendor for a build that issues per-device credentials plus a fleet-wide rotation of the exposed shared secret. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Anjvision YSSD-RTMP-H5 devices running firmware 3.3.2.4, isolate them from untrusted networks, restrict outbound access to only necessary vendor cloud endpoints, review cloud API logs for anomalous access, and contact Anjvision support to request a mitigation or patch timeline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Yssd Rtmp H5
View allUnauthenticated ONVIF service endpoints in Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 fail to enforce authe
Attackers who can reach the firmware update routine of Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can push arbitrary, unver
OS command injection in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows authenticated, low-privileged network attackers t
Authenticated users with any valid account on Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can silently reset the administrat
Server-side request forgery in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows unauthenticated remote attackers to invoke
Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 leaves an internal debug interface in the production image that can be t
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today