What is the CVSS score of EUVD-2026-89407?

EUVD-2026-89407 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate EUVD-2026-89407?

Within 24 hours, identify all Anjvision YSSD-RTMP-H5 devices running firmware 3.3.2.4, restrict network access to the management and user-information endpoints, and enforce least privilege for all accounts. Within 7 days, apply network segmentation and firewall rules to limit exposure to the affected endpoints, monitor logs for anomalous authenticated access, and contact Anjvision to request a patch timeline or mitigation guidance. Within 30 days, evaluate replacing or upgrading the affected firmware if a secure version becomes available, implement permanent configuration hardening to eliminate non-default states, and conduct a security review of all deployed IoT cameras to ensure similar exposures are mitigated.

Anjvision YSSD-RTMP-H5 EUVD-2026-89407

| CVE-2026-100298 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-09-29 ics-cert@hq.dhs.gov

GHSA-r95x-fc77-vm43

Information Disclosure IoT Firmware

8.7

CVSS 4.0 · Vendor: hq

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privilege access to camera
Delivery

Query the two user-information endpoints
Exploit

Harvest exposed device and account credentials
Execution

Reuse credentials to authenticate as admin
Impact

Full device takeover

Vulnerability Assessment

Weakness	CWE CWE-522 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V6 - Authentication Credential protection in transit/storage
Exploitation Conditions	Requires a low-privilege authenticated account on the Anjvision YSSD-RTMP-H5 camera (firmware 3.3.2.4), per PR:L. Exploitation targets two specific user-information endpoints that leak sensitive device and account details, but only 'under conditions that are not intended for normal operation' - i.e., a non-default, misconfigured, or transient device state rather than the stock configuration. Limiting factors: prior authentication is needed, the leak is not present in normal operation, and the product is a niche IoT camera with limited deployment.
Impact	This flaw carries a vendor CVSS 4.0 base of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H), scored by CISA on behalf of the vendor. The network vector and low attack complexity are credible, but the VI:H/VA:H (integrity/availability) ratings are questionable for what CWE-522 (Insufficiently Protected Credentials) and the description present as a disclosure issue - the description only says the endpoints 'reveal sensitive device and account details.' The high integrity/availability impact is best read as a CHAINED consequence: leaked account credentials enable subsequent admin takeover of the camera, not a direct effect of the read itself. Two mitigating signals lower the practical priority: PR:L means an authenticated (low-privilege) account is required, and the trigger occurs only 'under conditions that are not intended for normal operation,' implying a non-default or transient device state rather than a stock configuration. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no evidence of active or automated exploitation. Net: a real credential-exposure weakness worth patching on this device class, but not a high-urgency, mass-exploitable issue given the authentication requirement, the narrow triggering conditions, and the product's small footprint.
Exploit ScenarioDerived	An attacker who already holds a low-privilege account on the camera (or has reached its management interface on the LAN) queries the two user-information endpoints while the device is in the unintended state described, and reads back sensitive device data and account credentials. Those credentials are then reused to log in with higher privileges and take over the camera. No public exploit code is identified at the time of analysis.

This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Information disclosure in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows an authenticated, low-privilege user (CVSS vector PR:L) to reach two user-information endpoints that expose sensitive device and account details. The leak is not reproducible in normal operation - it appears only in a non-default, misconfigured, or transient device state - and it is a confidentiality-only exposure in the independent assessment (C:H/I:N/A:N), even though CISA, scoring on behalf of the vendor, assigned a CVSS 4.0 base of 8.7 that also claims high integrity and availability impact. There is no public exploit identified at time of analysis (no CISA KEV listing, no POC reference in the advisory data), and the affected product is a niche RTMP/H5 IoT camera with limited deployment, which constrains real-world risk.

RemediationAI

No vendor-released patch was identified at time of analysis for Anjvision YSSD-RTMP-H5 firmware 3.3.2.4, so remediation is compensating-control driven; monitor the CISA advisory ICSA-26-272-05 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05) for a firmware fix and vendor guidance, and engage Anjvision directly for a patched build and an exact fixed version before planning upgrades. Until then, isolate the cameras on a dedicated management VLAN with strict firewall rules so the device's HTTP/management interface is reachable only from authorized administrative hosts - accepting the trade-off that remote/cloud viewing and remote RTMP publishing to the device may require a VPN or jump host to keep working. Block inbound access to the camera's web interface from the internet and from general-purpose user subnets (the trade-off is loss of convenient browser-based viewing for end users, who must instead consume the RTMP/HLS stream). Audit and remove unused or default accounts, rotate all camera passwords and any credentials previously stored or entered on the device, since CWE-522 exposure of account details should be treated as potential credential compromise (trade-off: credential rotation may require re-provisioning integrations and streaming clients). Harden by disabling unused web endpoints and services where the firmware permits, restrict low-privilege accounts to the minimum roles needed, and enable logging/alerting on requests to user-information endpoints to detect enumeration attempts - noting that log volume on resource-constrained cameras is limited and can affect device performance. Finally, because the flaw only manifests in a non-default or transient device state, enforce configuration baselines and change-control on these devices to avoid the misconfigured states that trigger the disclosure, and monitor for unexpected reboots or configuration resets that could place a camera in that state.

Affected VersionsENISA

YSSD-RTMP-H5 Version 3.3.2.4 build 2024-12-26

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected target is an embedded IP camera / RTMP-H5 streaming device running firmware 3.3.2.4. CWE-522 (Insufficiently Protected Credentials) identifies the root-cause class: device and account information is stored or returned without adequate protection, and two HTTP-facing "user-information" endpoints on the management interface will surface that data when the device is in an abnormal or non-default state rather than in its intended operational mode. Because the exposed endpoints sit on the device's network-accessible web/API surface, the attack path is network-reachable (AV:N) and requires only a low-privilege account (PR:L, no user interaction), meaning a legitimate but unprivileged account can be leveraged to harvest information that should be restricted to higher-privileged roles. The disagreement between the vendor/CISA CVSS 4.0 vector (VC:H/VI:H/VA:H, base 8.7) and the independent CVSS 3.1 vector (S:U/C:H/I:N/A:N) is material: the independent reading characterizes this strictly as a confidentiality breach with no demonstrated integrity or availability loss, so downstream consumers should plan for credential/device-data exposure rather than for device compromise or denial of service.

Know when Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (hq) PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 6.5 MEDIUM

Authenticated (PR:L) network read of two endpoints exposing credentials gives C:H; integrity/availability impact is a follow-on of credential reuse, not the disclosure itself, so I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation.

Executive ViewAI

Why It Matters

Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 contain an information disclosure flaw that allows authenticated low-privilege users to access sensitive device and account details under specific non-default or transient conditions. Although no public exploit has been identified and the product has limited deployment, the absence of a vendor patch means affected organizations must rely on compensating controls to prevent unauthorized data exposure. Security leadership should prioritize inventory and network isolation of these devices, particularly in regulated or sensitive environments where account information leakage could trigger compliance concerns.

Business Impact: Medium

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include network segmentation and firewall rules to restrict access to the vulnerable endpoints, enforcement of strict least privilege for authenticated users, disabling unnecessary services, monitoring for anomalous access, and ensuring devices are not in non-default or misconfigured states.

Threat Intelligence Overview

EPSS Score

0.3%

Top 81% exploitable

Prevalence

Low

niche IoT RTMP camera, no meaningful enterprise footprint

Threat Intel

1 sources

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CISA

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat Yes

Deciding rule

Active threat signals + CRITICAL/HIGH severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Medium

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: +10

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.