Authentication Bypass in Anjvision YSSD-RTMP-H5 Firmware
CVE-2026-100296

7.2HIGH

Key Information:

Vendor

Anjvision

Status
Yssd-rtmp-h5
Vendor
CVE Published:
29 September 2026

What is CVE-2026-100296?

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, a vulnerability exists where an authenticated user can perform an empty-body POST request to the /setUserConfig endpoint. This action triggers the web server's SOAP-RPC handler, resulting in the administrator password being silently reverted to its default value. Moreover, this flaw compromises the in-memory authentication state of the device until it reloads, as the handler does not adequately verify the session's privilege level.

Affected Version(s)

YSSD-RTMP-H5 Version 3.3.2.4 build 2024-12-26

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
government-resource

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrew Lee reported these vulnerabilities to CISA.
.