CVE-2026-100295

Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 contains leftover debug code (CWE-489): an internal debug interface can be turned on through an undocumented pathway and then exposes functions that are not meant for normal operation. A remote attacker who already has low privileges can activate that interface over the network without user interaction. Once enabled, the interface can unintentionally grant elevated system access, with limited impact to confidentiality, integrity, and availability of the device itself (CVSS 4.0 5.3, medium). Only this firmware version is identified as affected. It is not listed in CISA KEV, and no public proof-of-concept or in-the-wild exploitation is known.

What to do: Treat Anjvision YSSD-RTMP-H5 devices running firmware 3.3.2.4 as affected and check the vendor for a firmware update; no fixed version is identified in the advisory data. Until a patch is available, keep the device off untrusted networks, require authenticated access only, and block or tightly restrict remote management so the undocumented debug pathway cannot be reached. Review logs and configuration for unexpected debug or elevated-access activity.