CVE-2026-51597
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The MERCURY MIPC252W IP camera firmware version 1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials.
Risk Assessment
The risk is unauthorized access to the live video stream by an attacker on the same local network, potentially leading to privacy breaches and unauthorized surveillance.
Recommendation
Immediately update the camera firmware to the latest version that implements nonce expiration in RTSP Digest authentication. If no update is available, restrict camera access to trusted networks and apply additional network security measures.
Other vulnerabilities in MERCURY MIPC252W
See all- CVE-2026-51599Critical
An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W allows an unauthenticated remote attacker to temporarily render an individual TCP connection unusable by sending an RTSP request with a Content-Length header but no message body. The parser enters a body-waiting state and consumes all subsequent data until timeout.
- CVE-2026-51598Medium
An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera (version 1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent attacker to cause a denial of service (DoS) via a crafted DESCRIBE request with a malformed URL.
Original NVD description (English source)
MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials, gaining unauthorized access to the live video stream.