CyberRota Analysis
AI-GeneratedThe Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 is vulnerable to a flaw that allows any authenticated user to reset the administrator password to its default value via an empty-body POST request to the /setUserConfig endpoint. This vulnerability compromises the device's authentication state, potentially allowing unauthorized access until the device is rebooted. Organizations using this firmware should prioritize patching to mitigate the risk of unauthorized administrative access.
Original NVD Description
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler does not verify the session's privilege level, so any authenticated user can trigger it.