# CVE-2026-100297: Anjvision YSSD-RTMP-H5 network probe SSRF

Source: https://junglewise.ai/threats/cve-2026-100297-in-anjvision-yssd-rtmp-h5-firmware-version-3-3-2-4-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-100297 · Severity: medium · CVSS 5.3 · Published 2026-09-29

Anjvision YSSD-RTMP-H5 is a networked media device used in commercial facilities worldwide. An unauthenticated attacker can abuse a network check function to probe arbitrary hosts on the internal network, potentially exposing sensitive information or enabling lateral reconnaissance and data exfiltration through DNS queries.

Technologies: [Anjvision YSSD-RTMP-H5](https://junglewise.ai/threats/technologies/yssd-rtmp-h5). Vendors: [Anjvision](https://junglewise.ai/threats/vendors/anjvision).

## Quick answers

**Is CVE-2026-100297 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100297 being exploited in the wild.

**How severe is CVE-2026-100297?** Medium severity, with a CVSS score of 5.3, published 29 September 2026.

**Which products and versions are affected?** Anjvision YSSD-RTMP-H5 3.3.2.4.

**Is there a fix for CVE-2026-100297?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100297 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-100297?** Check whether you run Anjvision YSSD-RTMP-H5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The firmware version 3.3.2.4 exposes an unauthenticated network diagnostic endpoint that allows arbitrary host probing from the device's vantage point on the internal network, a classic server-side request forgery (SSRF) vulnerability. No authentication is required to trigger the check function, and the device's internal network position makes it an effective pivot point for reconnaissance. The vulnerability allows attackers to map internal infrastructure and leak data via DNS resolution queries.

## Affected products

- Anjvision YSSD-RTMP-H5 3.3.2.4

## Timeline

- 2026-09-29: disclosed

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05](https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05)

## Related threats

- [Anjvision YSSD-RTMP-H5 weak cryptography in serial console](https://junglewise.ai/threats/cve-2026-100299-in-anjvision-yssd-rtmp-h5-firmware-version-3-3-2-4-the-device)
- [Anjvision YSSD-RTMP-H5 information disclosure in user endpoints](https://junglewise.ai/threats/cve-2026-100298-in-anjvision-yssd-rtmp-h5-firmware-version-3-3-2-4-two-user)
- [Anjvision YSSD-RTMP-H5 privilege escalation in /setUserConfig](https://junglewise.ai/threats/cve-2026-100296-in-anjvision-yssd-rtmp-h5-firmware-version-3-3-2-4-an-empty-body)
- [Anjvision YSSD-RTMP-H5 debug interface exposure](https://junglewise.ai/threats/cve-2026-100295-in-anjvision-yssd-rtmp-h5-firmware-version-3-3-2-4-an-internal)
- [Anjvision YSSD-RTMP-H5 hardcoded credential in firmware](https://junglewise.ai/threats/cve-2026-100294-in-anjvision-yssd-rtmp-h5-firmware-version-3-3-2-4-the-firmware)