CVE-2026-100292

Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 contains a hidden debug interface that an already authenticated user can turn on over the network. Once enabled, the interface accepts additional commands to a backend service and can pass crafted input into an underlying command handler, which is classified as OS command injection (CWE-78). A low-privileged attacker can then reach system-level functions on the device, with high impact to confidentiality, integrity, and availability of that system and no indicated impact on downstream systems. Only firmware version 3.3.2.4 is identified as affected. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Treat firmware 3.3.2.4 as vulnerable and apply any vendor firmware update that removes or locks the hidden debug interface; the advisory data does not name a fixed version, so confirm the patched build with Anjvision or CISA ICS before upgrading. Until then, keep the device off untrusted networks, restrict management access to authenticated administrators only, and block or monitor requests that enable debug features or pass unexpected command input to backend services. Review device logs for unexpected debug activation and plan to replace units that cannot be patched.