Anjvision YSSD-RTMP-H5 EUVD-2026-89408

Exploitation requires physical access to the device's serial (UART) console on the Anjvision YSSD-RTMP-H5 camera plus at least low-level local privilege (PR:L) to read the stored legacy password hash; the hash is protected only by weak DES-based encryption, so it can then be cracked offline. Limiting factors: the physical attack vector (AV:P) rules out any remote or network exploitation, an attacker must already be at the hardware, and full impact depends on successfully cracking the recovered hash to obtain usable credentials. This is a physical-access hardening weakness, not a remotely reachable vulnerability.

This is a genuinely low-urgency issue despite the 7.0 (CVSS 4.0 High) headline score, because the dominant limiting factor is the physical attack vector. The vendor's CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) requires an attacker to have physical access to the device's serial (UART) console AND already hold some level of local privilege (PR:L) to read the legacy DES-based password hash. There is no EPSS score, no CISA KEV listing, and no public exploit provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The three signals are consistent rather than conflicting: a physical-only vector (AV:P) plus no exploitation evidence points to a hardening/defense-in-depth weakness rather than a remotely weaponizable flaw. One internal tension worth noting: the vendor assigns full VC:H/VI:H/VA:H impact, which is only realized if cracking the weak DES hash yields credentials that grant complete device control - plausible for an IoT camera with a single privileged account, but the 'weak DES encryption' (CWE-1391) is fundamentally a credential-recovery/information-disclosure primitive, and integrity/availability impact is a downstream consequence of the recovered password, not a direct effect. Treat as a low-priority firmware hardening item for physically exposed deployments.

An attacker with physical access to a deployed Anjvision YSSD-RTMP-H5 camera connects to the exposed serial/UART console and retrieves the legacy DES-based password hash. Because DES-based hashing is cryptographically weak, the attacker cracks it offline in a short time to recover the plaintext credential, then reuses it to gain privileged control of the device. No public exploit code is identified, and the physical-access requirement makes this a targeted rather than scalable attack.