CVE-2026-51597
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The MERCURY MIPC252W IP camera firmware version 1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials.
Risk Assessment
The risk is unauthorized access to the live video stream by an attacker on the same local network, potentially leading to privacy breaches and unauthorized surveillance.
Recommendation
Immediately update the camera firmware to the latest version that implements nonce expiration in RTSP Digest authentication. If no update is available, restrict camera access to trusted networks and apply additional network security measures.
Original NVD description (English source)
MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials, gaining unauthorized access to the live video stream.