CVE-2026-100291CWE-1188

CVE-2026-100291

Critical · published September 30, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
25.0
In the wild
Unconfirmed
What it is

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00331 · 25.0th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2026-09-30T00:17Z
References (1)
https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05 · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 19:34Z
    Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5
    cvelistv5