CVE-2026-100295 Active debug code in Anjvision YSSD-RTMP-H5
An undocumented pathway enables an internal debug interface in Anjvision YSSD-RTMP-H5 firmware, potentially granting elevated system access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100295?
CVE-2026-100295 is a medium-severity vulnerability in Anjvision YSSD-RTMP-H5, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal operation. When activated, this interface allows actions that could unintentionally provide elevated system access.
Weakness: CWE-489
Which versions are affected by CVE-2026-100295?
How do I fix CVE-2026-100295?
No fix has been published for CVE-2026-100295 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-100295 being exploited?
There is no known exploitation of CVE-2026-100295 in the wild and no public exploit code.
Sources
Also known as GHSA-275m-97x4-pj34.