CVE-2026-100296 in YSSD-RTMP-H5
Summary
by MITRE • 09/29/2026
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler does not verify the session's privilege level, so any authenticated user can trigger it.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 represents a critical failure in access control and state management within the device’s web server implementation. Specifically, the SOAP-RPC handler responsible for processing requests to the /setUserConfig endpoint exhibits insufficient validation of user privileges before executing configuration changes. This architectural flaw allows any authenticated user, regardless of their assigned role or privilege level, to interact with administrative functions that should be restricted exclusively to high-privilege accounts. The core technical issue lies in the absence of a mandatory access control check during the processing of POST requests directed at this specific endpoint. By leveraging an empty-body POST request, an attacker can bypass standard input validation mechanisms and trigger internal logic intended for privileged operations without providing necessary configuration parameters or authentication tokens that would typically be required to validate intent and authority.
The operational impact of this vulnerability is severe, as it directly compromises the integrity of administrative credentials on the target device. When exploited, the flaw causes a silent downgrade of the administrator password back to its default factory value. This action effectively neutralizes any custom security measures implemented by administrators who have changed the default credentials upon initial setup. Furthermore, the exploit corrupts the in-memory authentication state of the system. Because this corruption persists until the device undergoes a full reload or reboot, an attacker can maintain persistent unauthorized access during this window. The silent nature of the downgrade means that legitimate users may not immediately notice the compromise, allowing attackers to establish long-term footholds within the network infrastructure protected by the compromised surveillance device.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Control, as it allows lower-privileged entities to perform actions reserved for higher-privileged roles. Additionally, the exploitation technique relates to CWE-862, Missing Authorization Check, since the application fails to verify that the user has the necessary permissions before executing sensitive configuration changes. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates lateral movement and privilege escalation within an IoT or OT environment. Attackers can use this flaw to escalate from a standard operator account to full administrative control, enabling them to manipulate device configurations, exfiltrate video streams, or pivot further into the connected network. The lack of session validation also highlights weaknesses in CWE-613, Insufficient Session Expiration, as the corrupted state persists until an external event like a reboot occurs, extending the window of opportunity for exploitation.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective short-term solution is to apply the vendor-provided firmware update that patches this specific logic flaw in the SOAP-RPC handler. Until such updates are available or deployed, network segmentation should be enforced to restrict access to the device’s management interface exclusively from trusted administrative subnets. Implementing strict input validation and enforcing role-based access control checks at the API gateway level can also help mitigate similar vulnerabilities across other endpoints. Security teams should monitor for anomalous POST requests targeting configuration endpoints and ensure that default credentials are changed immediately upon deployment, although this specific flaw renders such measures temporarily ineffective until a reboot or patch is applied. Regular audits of authentication logs and privilege escalation attempts will aid in detecting exploitation activities early.