Yssd Rtmp H5
Monthly
Authenticated users with any valid account on Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can silently reset the administrator password back to its default value and corrupt the device's in-memory authentication state by sending an empty-body HTTP POST to the /setUserConfig endpoint, which the web server routes through its SOAP-RPC handler without ever checking the caller's privilege level. Because the handler trusts any authenticated session as administrative, a low-privileged account is effectively sufficient to seize administrative control and to cause an availability impact on the device; only a device reload clears the corrupted state. Exploitation requires a valid account on the web interface (PR:L per the CVSS 4.0 vector and our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), and no public exploit code or active exploitation has been identified at time of analysis - the issue was surfaced through CISA ICS advisory ICSA-26-272-05 rather than through observed attacks.
Hardcoded, shared cloud-API credentials baked into Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 can be extracted by anyone who obtains the publicly distributed firmware package and then reused against the vendor's cloud service in ways outside normal device operation, exposing data the cloud API is meant to protect. The issue is exploitable remotely with no authentication or user interaction (CVSS 4.0 8.7: AV:N/AC:L/AT:N/PR:N/UI:N, VC:H with VI:N/VA:N; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), limited primarily by the attacker's ability to reach the cloud endpoint and by the credentials remaining valid and unrotated. No public exploit identified at time of analysis, and practical exposure is reduced by the narrow deployment footprint of this specific ICS/IoT streaming device.
Attackers who can reach the firmware update routine of Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can push arbitrary, unverified firmware images to the device and take full control of it, because both the local and the cloud update paths validate only a basic hash instead of a cryptographic signature. The flaw is a design-level chain-of-trust failure (CWE-347) scored 8.7 under CVSS 4.0, and per the associated CVSS vector it requires low-level privileges (PR:L) with no user interaction (UI:N) while impacting confidentiality, integrity and availability equally. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so practical urgency is driven mainly by device exposure; real-world risk is further bounded by Anjvision's very small deployment footprint.
OS command injection in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows authenticated, low-privileged network attackers to enable a hidden debug interface and then deliver crafted input to a backend command handler, resulting in high impact to confidentiality, integrity, and availability of the device (assessed CVSS:3.1 8.7, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires network reachability to the device's management/control service, valid credentials of at least low privilege, and the specific firmware build; no user interaction is needed, and no public exploit identified at time of analysis. No confirmed vendor patch version is present in the available advisory data, so affected deployments should treat exposure reduction as the immediate priority.
Unauthenticated ONVIF service endpoints in Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 fail to enforce authentication on management requests, letting any attacker who can route to the device invoke sensitive device operations directly. No credentials, user interaction, or non-default configuration are required - the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is a remotely reachable, unauthenticated flaw in the default request-handling path, and the independent assessment rates it a genuine high-priority issue with high confidentiality, integrity, and availability impact. Exploitation is limited only by network exposure (same LAN, VPN, or an internet-exposed/port-forwarded device); no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), though the CISA ICS advisory ICSA-26-272-05 documents the issue.
Server-side request forgery in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows unauthenticated remote attackers to invoke the device's built-in network-check/connectivity-probe function and make it issue requests to arbitrary hosts reachable from the camera's internal network. The resulting impact is limited to low-confidentiality disclosure -- internal host enumeration and small data leaks via DNS resolution -- with no integrity or availability effect, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue was reported through CISA's ICS-CERT program as ICSA-26-272-05.
Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 leaves an internal debug interface in the production image that can be turned on through an undocumented activation pathway, exposing diagnostic functions that can provide elevated system access once enabled. Attackers cannot trigger the exposure blindly: reaching the interface requires network access to the device plus at least low-privilege authenticated access (CVSS vector PR:L) and knowledge of the undocumented activation method, which is not publicly documented, and no user interaction is needed. Rated CVSS 5.3 (moderate), there is no public exploit identified at time of analysis and no confirmed active exploitation; the practical risk is post-authentication privilege escalation and unauthorized configuration or information access on affected devices reachable from an untrusted network.
Authenticated users with any valid account on Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can silently reset the administrator password back to its default value and corrupt the device's in-memory authentication state by sending an empty-body HTTP POST to the /setUserConfig endpoint, which the web server routes through its SOAP-RPC handler without ever checking the caller's privilege level. Because the handler trusts any authenticated session as administrative, a low-privileged account is effectively sufficient to seize administrative control and to cause an availability impact on the device; only a device reload clears the corrupted state. Exploitation requires a valid account on the web interface (PR:L per the CVSS 4.0 vector and our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), and no public exploit code or active exploitation has been identified at time of analysis - the issue was surfaced through CISA ICS advisory ICSA-26-272-05 rather than through observed attacks.
Hardcoded, shared cloud-API credentials baked into Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 can be extracted by anyone who obtains the publicly distributed firmware package and then reused against the vendor's cloud service in ways outside normal device operation, exposing data the cloud API is meant to protect. The issue is exploitable remotely with no authentication or user interaction (CVSS 4.0 8.7: AV:N/AC:L/AT:N/PR:N/UI:N, VC:H with VI:N/VA:N; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), limited primarily by the attacker's ability to reach the cloud endpoint and by the credentials remaining valid and unrotated. No public exploit identified at time of analysis, and practical exposure is reduced by the narrow deployment footprint of this specific ICS/IoT streaming device.
Attackers who can reach the firmware update routine of Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can push arbitrary, unverified firmware images to the device and take full control of it, because both the local and the cloud update paths validate only a basic hash instead of a cryptographic signature. The flaw is a design-level chain-of-trust failure (CWE-347) scored 8.7 under CVSS 4.0, and per the associated CVSS vector it requires low-level privileges (PR:L) with no user interaction (UI:N) while impacting confidentiality, integrity and availability equally. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so practical urgency is driven mainly by device exposure; real-world risk is further bounded by Anjvision's very small deployment footprint.
OS command injection in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows authenticated, low-privileged network attackers to enable a hidden debug interface and then deliver crafted input to a backend command handler, resulting in high impact to confidentiality, integrity, and availability of the device (assessed CVSS:3.1 8.7, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires network reachability to the device's management/control service, valid credentials of at least low privilege, and the specific firmware build; no user interaction is needed, and no public exploit identified at time of analysis. No confirmed vendor patch version is present in the available advisory data, so affected deployments should treat exposure reduction as the immediate priority.
Unauthenticated ONVIF service endpoints in Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 fail to enforce authentication on management requests, letting any attacker who can route to the device invoke sensitive device operations directly. No credentials, user interaction, or non-default configuration are required - the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is a remotely reachable, unauthenticated flaw in the default request-handling path, and the independent assessment rates it a genuine high-priority issue with high confidentiality, integrity, and availability impact. Exploitation is limited only by network exposure (same LAN, VPN, or an internet-exposed/port-forwarded device); no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), though the CISA ICS advisory ICSA-26-272-05 documents the issue.
Server-side request forgery in Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 allows unauthenticated remote attackers to invoke the device's built-in network-check/connectivity-probe function and make it issue requests to arbitrary hosts reachable from the camera's internal network. The resulting impact is limited to low-confidentiality disclosure -- internal host enumeration and small data leaks via DNS resolution -- with no integrity or availability effect, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue was reported through CISA's ICS-CERT program as ICSA-26-272-05.
Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 leaves an internal debug interface in the production image that can be turned on through an undocumented activation pathway, exposing diagnostic functions that can provide elevated system access once enabled. Attackers cannot trigger the exposure blindly: reaching the interface requires network access to the device plus at least low-privilege authenticated access (CVSS vector PR:L) and knowledge of the undocumented activation method, which is not publicly documented, and no user interaction is needed. Rated CVSS 5.3 (moderate), there is no public exploit identified at time of analysis and no confirmed active exploitation; the practical risk is post-authentication privilege escalation and unauthorized configuration or information access on affected devices reachable from an untrusted network.