CVE-2026-100296 is a vulnerability in Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4. The issue arises from improper checking of unusual or exceptional conditions (CWE-754) in the SOAP-RPC handler for the /setUserConfig endpoint. Specifically, an empty POST request body causes the administrator password to be silently downgraded to the default password and corrupts the in-memory authentication state until the device reloads. The handler fails to verify the privilege level of the session, enabling any authenticated user to exploit this flaw.

The vulnerability allows any authenticated user, regardless of privilege level, to reset the administrator password to its default value and disrupt the device's authentication state. This can lead to unauthorized administrative access after the device reloads, compromising device integrity and control. The CVSS 3.1 base score is 8.1 (high), reflecting the ease of exploitation (network attack vector, low attack complexity, low privileges required, no user interaction) and significant impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to trusted individuals only and monitor for suspicious POST requests to /setUserConfig. Consider device reload procedures to restore normal authentication state after exploitation attempts.