CVE-2026-100291

Summary

The flaw allows an unauthorized attacker to access sensitive device operations by bypassing required authentication, potentially leading to full device compromise.

Exploitability

Exploitation is relatively easy as no authentication is enforced, requiring only knowledge of the affected ONVIF service endpoints.

Blast radius

If exploited, the attacker could gain full control over the device, leading to data theft, denial of service, or other severe consequences.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Anjvision YSSD-RTMP-H5 firmware version 3.3.2.5 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.