CVE-2026-100293 - Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5 · CoreCVE

Back Back to CVE browser

HIGH

Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5

Published Sep 29, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.18%

Description

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the device will accept as valid.

Affected products

Vendor Anjvision Product Yssd-Rtmp-H5 Default
unaffected
Affected
- Version 3.3.2.4 build 2024-12-26

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Anjvision	Yssd-Rtmp-H5	unaffected	Affected Version 3.3.2.4 build 2024-12-26

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-347

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-89368
Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05
government-resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-89368		Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05		government-resource

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner icscert

Published Sep 29, 2026

Updated Sep 29, 2026

Reserved Sep 25, 2026

Link CVE-2026-100293

CISA Vulnrichment

Updated Sep 29, 2026

NVD

Status Deferred

Modified Sep 29, 2026

Link CVE-2026-100293

Red Hat

No data

ENISA EUVD

Assigner icscert

Published Sep 29, 2026

Updated Sep 29, 2026

Link EUVD-2026-89368

GitHub

No data