CVE-2026-100297
Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries.
| CWE | CWE-918 |
| Vendor | anjvision |
| Product | yssd-rtmp-h5 |
| Published | Sep 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for anjvision yssd-rtmp-h5
Be the first to know when new medium vulnerabilities affecting anjvision yssd-rtmp-h5 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Anjvision / YSSD-RTMP-H5
Version 3.3.2.4 build 2024-12-26
References
Credits
Andrew Lee reported these vulnerabilities to CISA.