CVE-2026-100293

Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 applies updates from both its local and cloud update mechanisms without cryptographic signature checks, relying only on basic hashing. An attacker who can reach the update routine over the network, with low privileges and no user interaction, can submit an untrusted firmware image that the device accepts as valid and installs. That yields high impact on the device itself—confidentiality, integrity, and availability—typically meaning persistent control of the appliance and anything it streams or stores. The flaw is CVE-2026-100293 (CWE-347), scored 8.7 (high) under CVSS 4.0, and was assigned by ICS-CERT. It is not in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Treat Anjvision YSSD-RTMP-H5 devices on firmware 3.3.2.4 as vulnerable and keep their management and update interfaces off untrusted networks. Restrict who can reach local and cloud update functions, apply only vendor-supplied firmware over a trusted path, and ask Anjvision for a release that cryptographically verifies images. Watch for unexpected firmware changes or reboots until a signed-update build is available.