CVE-2026-100291

CRITICALCVSS 9.8

Description

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.

Timeline

Published:September 29th, 2026 8:17 PM

Last modified:September 29th, 2026 10:17 PM

CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-1188

References & Reports

Advisories, patches, and third-party reports

https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05

Source: NIST NVD · Data may lag official sources by up to one minute