CVE-2026-51599
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W allows an unauthenticated remote attacker to temporarily render an individual TCP connection unusable by sending an RTSP request with a Content-Length header but no message body. The parser enters a body-waiting state and consumes all subsequent data until timeout.
Risk Assessment
An attacker can temporarily disrupt a single TCP connection, potentially causing denial of service (DoS) for specific sessions and impacting network service availability.
Recommendation
Update the router firmware to the latest version that fixes the RTSP request validation. If no update is available, restrict RTSP service access to trusted networks only.
Other vulnerabilities in MERCURY MIPC252W
See all- CVE-2026-51597Critical
The MERCURY MIPC252W IP camera firmware version 1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials.
- CVE-2026-51598Medium
An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera (version 1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent attacker to cause a denial of service (DoS) via a crafted DESCRIBE request with a malformed URL.
Original NVD description (English source)
An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding message body. The affected RTSP parser enters a body-waiting state instead of rejecting the malformed request, causing all subsequent data on the connection to be silently consumed as body content until a server-side timeout closes the connection.