CVE-2026-100294: Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-29 · updated 2026-09-29
Weakness: CWE-798

Description

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation.

Affected products

Anjvision YSSD-RTMP-H5: Version 3.3.2.4 build 2024-12-26

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05

Get alerted when CVE-2026-100294 or the next vulnerability affects your stack