External risk intelligence

Anjvision YSSD‑RTMP‑H5 Firmware ONVIF Service Endpoint Unauthorized Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-100291

The vulnerability exists in ONVIF service endpoints within surveillance camera firmware. ONVIF is a standard protocol for IP-based security products, which are frequently deployed in internet-facing configurations or connected to edge networks to facilitate remote monitoring and management.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the firmware of Anjvision surveillance devices, specifically affecting ONVIF service endpoints. This issue allows unauthorized access to device management functions, potentially exposing sensitive operations. The main concern at this stage is confirming if these devices are in use and relevant to our environment.

Unauthenticated access to device management functions.
Critical vulnerability in widely used surveillance systems.
Confirm relevance and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by targeting the device over the network, as the ONVIF service endpoints are exposed without authentication. This allows unauthorized access to sensitive device operations, potentially leading to a compromise of the device's management functions.

Exposed on the network.
Unauthenticated ONVIF service endpoints.
Unauthorized access to sensitive operations.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the management functions of Anjvision YSSD‑RTMP‑H5 firmware when exposed to a network, potentially allowing unauthorized access to sensitive device operations.

Device management functions at risk.
Unauthorized access to sensitive operations.
Compromised device control and monitoring.

Operational Fix

Recommended remediation, mitigation, and detection steps

The firmware's ONVIF service endpoints require immediate attention from security and infrastructure teams, as they process management requests without proper authentication, potentially exposing sensitive device operations to unauthorized access. The first practical step is to identify all deployed instances of the affected technology, verify their network exposure and business criticality, pinpoint the accountable system owner, and then develop a prioritized remediation plan.

Identify and verify affected assets.
Confirm network exposure and business criticality.
Plan vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Anjvision YSSD‑RTMP‑H5 device?

This product is a surveillance camera that uses firmware version 3.3.2.4. It relies on the ONVIF standard, a global open-interface protocol, to allow interoperability between IP-based security devices like cameras and recording software. Users deploy these for remote video monitoring and centralized management of physical security systems.

What does CWE-1188 mean for CVE-2026-100291?

CWE-1188 refers to the insecure default initialization of a resource. In this context, the camera firmware fails to properly secure its ONVIF service endpoints. Because the system does not require authentication for these management tasks, the software effectively leaves its most sensitive administrative functions open to anyone who can reach the service over the network.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending unauthorized management requests directly to the camera's ONVIF service endpoints over the network. The vulnerability does not require complex preconditions; simply being able to communicate with the device's management interface is sufficient. Note that authentication attempts are not a prerequisite, as the system does not enforce them.

Is my device relevant according to Halo Surface Signal?

Halo Surface Signal indicates this is a high-priority concern because surveillance cameras often sit on edge networks or are placed in internet-facing configurations to enable remote access. If your Anjvision device is accessible from outside your local network or resides on an open edge segment, it matches the high-risk usage pattern identified for this vulnerability.

What should I do if I have these cameras?

Your first step is to inventory your network to locate all instances of this specific hardware and firmware version. Once identified, verify if the devices are exposed to the internet or reachable from untrusted networks. Establish who owns these assets within your organization and coordinate with them to prioritize a remediation plan, such as restricting network access while awaiting vendor guidance.

References

www.cisa.gov/news-events/ics-advisories/icsa-26-272-05

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.