MERCURY MIPC252W vulnerabilities

An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W allows an unauthenticated remote attacker to temporarily render an individual TCP connection unusable by sending an RTSP request with a Content-Length header but no message body. The parser enters a body-waiting state and consumes all subsequent data until timeout.

The MERCURY MIPC252W IP camera firmware version 1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials.

An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera (version 1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent attacker to cause a denial of service (DoS) via a crafted DESCRIBE request with a malformed URL.