Security 1 publisher1 min readPublished Sep 29, 2026, 9:50 AM PDT

CISA publishes nine Anjvision YSSD-RTMP-H5 flaws with no fix planned

CISA published nine flaws in Anjvision's YSSD-RTMP-H5 firmware with no fix planned, saying the vendor has not answered its requests. Owners have no patch to wait for and must isolate the devices or replace them.

The Watch · Security desk

What happened

Several ONVIF service endpoints on firmware 3.3.2.4 accept management requests without enforcing authentication, according to CISA.
The firmware embeds cloud-API credentials that are identical across deployed devices and can be recovered from the public firmware package.
Local and cloud firmware updates are checked only by basic hashing, so the device accepts untrusted images from anyone who can reach the update routine.
CISA lists the product's sector as Commercial Facilities, its deployment as worldwide, and the vendor's headquarters as China.

Compiled by The WatchSomething wrong?How this is made

Why it matters

exposure Any host with a route to an affected unit's ONVIF service can send it management requests, including other machines on the same internal network.
exposure Pulling the shared cloud-API credential out of one firmware download gives an attacker a value that is valid for every deployed unit, not one.
decision A unit that may already have been reached cannot be assumed to run Anjvision's code afterward, because its updater accepts untrusted images; replacement is easier to verify than a reflash.

Ranked by what an attacker needs, the ONVIF flaw comes first because it asks for no credentials ^[5]. CISA files it under CWE-1188, initialization of a resource with an insecure default ^[5]. The command-execution flaw needs more. A hidden debug interface has to be switched on through an authenticated request before crafted input reaches the backend command handler, a CWE-78 command injection ^[6].

Full control of the device appears in CISA's summary of the flaws as a group, next to OS command execution, access to user accounts and exposure of sensitive information ^[10]. The ONVIF entry itself stops at access to "sensitive device operations" ^[5]. A second debug interface, enabled through an undocumented pathway, can give elevated system access, and CISA's description of that pathway does not say whether it needs a login ^[9].

CISA's entry on the shared cloud-API credential says it can be reused to interact with the cloud service "in ways not intended for normal operation" ^[8].

All nine identifiers, CVE-2026-100291 through CVE-2026-100299, are filed against one build, 3.3.2.4_build_2024-12-26 ^[1]. The build string carries a date of December 26, 2024 ^[1]. Anjvision has not responded to CISA's requests to work on mitigation, according to the advisory, and the listed remediation is "No fix planned" ^[3]^[2]. The only route CISA gives owners is Anjvision's customer support page ^[4].

What to watch

Any report of exploitation, or public proof-of-concept code, against the ONVIF endpoints or either debug interface.
A reply from Anjvision to CISA, or a firmware build newer than 3.3.2.4_build_2024-12-26, that changes the "No fix planned" status.
Research showing whether the shared cloud-API credentials reach the cloud update path; that would join two findings into a remote firmware-replacement chain.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
CISA's advisory lists nine CVEs, CVE-2026-100291 through CVE-2026-100299, affecting Anjvision YSSD-RTMP-H5 firmware 3.3.2.4_build_2024-12-26.
ReportedSupportedSource: CISA ICS advisoryView cited source
[2]
The remediation CISA lists for the affected firmware is "No fix planned".
ReportedSupportedSource: CISA ICS advisoryView cited source
[3]
Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities.
ReportedSupportedSource: CISA ICS advisoryView cited source
[4]
Users of affected versions are invited to contact Anjvision customer support for additional information.
ReportedSupportedSource: CISA ICS advisoryView cited source
[5]
In firmware 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication, which could allow an unauthorized attacker to access sensitive device operations; CWE-1188 Initialization of a Resource with an Insecure Default.
ReportedSupportedSource: CISA ICS advisoryView cited source
[6]
A hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service; once active it can expose system-level functionality if crafted inputs reach the underlying command handler; CWE-78 OS Command Injection.
ReportedSupportedSource: CISA ICS advisoryView cited source
[7]
Both the local and cloud update mechanisms apply new firmware without cryptographic verification, relying only on basic hashing, allowing an attacker who can reach the update routine to introduce untrusted firmware images the device will accept as valid; CWE-347.
ReportedSupportedSource: CISA ICS advisoryView cited source
[8]
The firmware embeds hardcoded cloud-API credentials shared across deployed devices; anyone obtaining the public firmware package can reuse these values to interact with the cloud service "in ways not intended for normal operation"; CWE-798.
ReportedSupportedSource: CISA ICS advisoryView cited source
[9]
An internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal operation; when activated it allows actions that could provide elevated system access.
ReportedSupportedSource: CISA ICS advisoryView cited source
[10]
CISA's summary says successful exploitation could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device.
ReportedSupportedSource: CISA ICS advisoryView cited source
[11]
The advisory lists the critical infrastructure sector as Commercial Facilities, deployment as worldwide, and company headquarters as China.
ReportedSupportedSource: CISA ICS advisoryView cited source

Sources

Publishers with included, body-backed reporting in this cluster.

cisa.gov
1 article · September 29, 2026
Anjvision YSSD-RTMP-H5

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

A firmware team would recognise these flaws as design choices. The ONVIF management endpoints skip authentication. Cloud-API credentials are baked into a public image and shared by every unit. The update path checks a hash but no signature, so anyone who can reach it can load their own firmware. CISA also describes two separate debug interfaces, one of which leads to OS command injection.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence70: 0100
Primary source, unconfirmed elsewhere
Every claim comes from CISA's advisory, which names the exact firmware build, nine CVE numbers and a CWE class for each flaw, and CISA is the issuing authority. The text we have does not credit a researcher or publish exploit detail, and no second source confirms the findings.
AdoptionInsufficient: Deployment scale unknown
CISA labels deployment "Worldwide" in commercial facilities but does not include unit counts or customer names, so the exposed population cannot be sized.
Hype gap0: −100 understated0 aligned+100 overstated
Claims match the evidence
CISA keeps its impact language conditional: exploitation "could allow" full device control. The advisory does not claim attacks in the wild, and our headline stays with what the agency published.
IncentivesInsufficient: No incentive information
The advisory reports that Anjvision did not respond but did not say why. We have no basis for judging the vendor's or anyone else's motives.
Confidence65: 0100
Solid on the flaws, thin on reach
We are confident about what the flaws are and that no patch is coming, because CISA is both source and authority. How much the story matters depends on how many units are exposed, and that figure is missing.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

Anjvision YSSD-RTMP-H5Follow
ONVIF Follow
AnjvisionFollow
CISA Follow

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Sources

Let Clarity write the post for you.

Perspective Coverage

Reality

Topics and entities

Topics

Entities

Related stories