The flaw exists in the SOAP‑RPC handler for the /setUserConfig endpoint in Anjvision YSSD‑RTMP‑H5 firmware 3.3.2.4. An empty‑body POST request silently resets the administrator password to its default value and corrupts the in‑memory authentication state. Because the handler does not verify the authenticated user’s privilege level, any user who has already logged in can trigger the reset, potentially gaining full administrative control. This results in loss of integrity and confidentiality of the device configuration and could allow further attacks once the device self‑reboots.

Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4 is affected. No other product versions are listed as vulnerable.

The CVSS score of 7.2 indicates a high‑severity vulnerability. EPSS data is unavailable, so the likelihood of exploitation is unclear, but the flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. The attack likely proceeds after an attacker obtains any valid user credential and is able to send a SOAP‑RPC request to /setUserConfig, which could occur over the device’s local network or externally if the web interface is exposed.