CVE-2026-100296

Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 improperly handles an unusual empty user-configuration request sent to its web server SOAP-RPC handler (CWE-754). The handler does not check the session privilege level, so any authenticated user can trigger it. The device then silently sets the administrator password back to the default and corrupts in-memory authentication state until it is reloaded, which is scored as high integrity and availability impact with no confidentiality impact (CVSS 4.0 7.2). Only firmware 3.3.2.4 is identified as affected. The issue is not in CISA's KEV catalog, and no public proof-of-concept is known.

What to do: Treat YSSD-RTMP-H5 firmware 3.3.2.4 as vulnerable and install a vendor or CISA ICS-CERT fix when one is published; no patched version is identified in this data. Until then, do not expose the device web interface to the internet, limit which accounts can authenticate, and check whether the administrator password has reverted to the factory default after any unexpected authentication failure. A reload clears only the in-memory corruption and does not remove the flaw.