EUVD-2026-89405
GHSA-7frq-m6gw-j5xx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, trivial single request (AC:L), requires any authenticated account (PR:L); resets admin password (I:H) and corrupts auth state until reload (A:H); no data disclosure (C:N).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
6DescriptionCVE.org
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler does not verify the session's privilege level, so any authenticated user can trigger it.
AnalysisAI
Authenticated users with any valid account on Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can silently reset the administrator password back to its default value and corrupt the device's in-memory authentication state by sending an empty-body HTTP POST to the /setUserConfig endpoint, which the web server routes through its SOAP-RPC handler without ever checking the caller's privilege level. Because the handler trusts any authenticated session as administrative, a low-privileged account is effectively sufficient to seize administrative control and to cause an availability impact on the device; only a device reload clears the corrupted state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated session of any privilege level on the Anjvision YSSD-RTMP-H5 web interface (PR:L) - this is the primary limiting factor; unauthenticated attackers cannot trigger it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine privilege-escalation/integrity issue, not merely a high-CVSS paper risk, though it is bounded by an authentication prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, and the ICS-CERT advisory ICSA-26-272-05 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05) is the reference to monitor for a firmware fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Restrict network access to the device's web interface (typically ports 80/443) to trusted management networks only, enforce strong unique passwords for all accounts, and enable logging to monitor for HTTP POST requests to /setUserConfig. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A command injection vulnerability (CVSS 9.8). Risk factors: public PoC available.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stem
Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure o
Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege aut
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operatin
Share
External POC / Exploit Code
Leaving vuln.today