CVE-2026-100298

Anjvision's YSSD-RTMP-H5 streaming-media appliance firmware, version 3.3.2.4, exposes two user-information endpoints that return sensitive device and account details, including insufficiently protected credentials (CWE-522), under conditions that are not intended for normal operation. The CVSS 4.0 vector (8.7, high) indicates a network-exploitable flaw requiring only low-privilege authentication, meaning an attacker holding any valid low-privilege account on the device can query these endpoints and harvest account and device information they should never be able to see. The leaked details can plausibly enable takeover of the appliance with administrator-level access, which explains the high ratings for confidentiality, integrity, and availability — a compromised RTMP/H5 gateway could expose or manipulate the live surveillance video it brokers and serve as a pivot into the camera network. Only firmware version 3.3.2.4 is named in the advisory, which was issued through CISA's ICS-CERT. No public proof-of-concept exists and the flaw is not on the CISA Known Exploited Vulnerabilities list, so exploitation is not currently observed, but these appliances are frequently internet-facing and status may change.

What to do: Upgrade the YSSD-RTMP-H5 firmware past 3.3.2.4 as soon as Anjvision publishes a fix, and check the ICS-CERT advisory for the patched version. In the meantime, remove the appliance's management interface from the public internet by placing it behind a VPN or strict firewall allow-list, since only low-privilege credentials are needed to trigger the leak. Rotate all device and camera account credentials, eliminate default or shared accounts, and review device logs for unexpected requests to the two user-information endpoints from low-privilege users.