CVE-2026-100299: Use of Weak Credentials in Anjvision YSSD-RTMP-H5

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-29 · updated 2026-09-29
Weakness: CWE-1391

Description

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption.

Affected products

Anjvision YSSD-RTMP-H5: Version 3.3.2.4 build 2024-12-26

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05

Get alerted when CVE-2026-100299 or the next vulnerability affects your stack