CVE-2026-100296

Name of the Vulnerable Software and Affected Versions Anjvision YSSD-RTMP-H5 version 3.3.2.4

Description An issue exists in the web server's SOAP-RPC handler where it fails to verify the session's privilege level. An authenticated user can send an empty-body POST request to the '/setUserConfig' endpoint, which silently resets the administrator password to the default value and corrupts the in-memory authentication state. This state persists until the device is reloaded.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.