CVE-2026-51598
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera (version 1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent attacker to cause a denial of service (DoS) via a crafted DESCRIBE request with a malformed URL.
Risk Assessment
The attack can disable video streaming from the camera, preventing monitoring and potentially exposing the organization to physical security gaps.
Recommendation
Immediately update the camera firmware to the latest version and restrict access to the RTSP port (554) to trusted networks only.
Other vulnerabilities in MERCURY MIPC252W
See all- CVE-2026-51599Critical
An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W allows an unauthenticated remote attacker to temporarily render an individual TCP connection unusable by sending an RTSP request with a Content-Length header but no message body. The parser enters a body-waiting state and consumes all subsequent data until timeout.
- CVE-2026-51597Critical
The MERCURY MIPC252W IP camera firmware version 1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials.
Original NVD description (English source)
An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent attacker to cause a denial of service via a crafted DESCRIBE request with a malformed URL in the request line.