CVE-2026-100294

Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 embeds hardcoded cloud-API credentials that are shared across deployed devices (CWE-798). Anyone who obtains the public firmware package can extract those values and reuse them to interact with the vendor cloud service in ways not intended for normal operation. CVSS 4.0 rates this 8.7 (high): it is reachable over the network with low complexity and no privileges or user interaction, and the stated impact is high confidentiality loss on the vulnerable system, with no integrity or availability impact indicated. Every device running this firmware build is affected, because the same credentials are reused fleet-wide rather than issued per device. The CVE is not in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Treat the cloud-API credentials embedded in firmware 3.3.2.4 as exposed, because they are shared across devices and recoverable from the public firmware package. Ask Anjvision for a firmware update or credential rotation; no fixed version is identified in the advisory data. Until then, limit these devices’ outbound access to the cloud service and review cloud-API logs for use that does not match normal device operation.