EUVD-2026-25903Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts. By repeatedly sending RTSP requests with invalid authentication parameters, an unauthenticated attacker can cause the RTSP service to enter a persistent authentication failure state, preventing legitimate clients from authenticating and leading to a denial of service.
AnalysisAI
Denial of service in MERCURY IP camera MIPC252W version 1.0.5 Build 230306 allows unauthenticated local attackers to trigger persistent authentication failure in the RTSP service by sending repeated requests with invalid Digest authentication parameters, preventing legitimate clients from authenticating and causing service unavailability.
Technical ContextAI
The RTSP (Real Time Streaming Protocol) service in the MERCURY MIPC252W IP camera implements Digest authentication as a security mechanism. The vulnerability stems from improper handling of failed authentication attempts (CWE-307: Improper Restriction of Rendered UI Layers or Frames, though this CVE more closely relates to authentication state management). When an attacker sends multiple RTSP requests with malformed or invalid Digest authentication credentials, the service enters a persistent failure state rather than recovering gracefully, becoming unable to process subsequent authentication attempts from legitimate users. This affects the RTSP streaming subsystem, which is a core component of IP camera functionality for video transmission.
RemediationAI
Upgrade MERCURY MIPC252W firmware to a patched version if available from MERCURY; contact the vendor for guidance on available firmware updates and timelines. If a patched version is not available, implement the following compensating controls: (1) Restrict RTSP port 554 access at the network firewall to only authorized IP addresses or network segments - this eliminates remote exploitation but does not prevent local network attacks; (2) Isolate the camera on a separate VLAN or network segment, restricting access from untrusted devices or users; (3) Implement network-based rate limiting on RTSP requests to the camera to slow brute-force authentication attempts, though this may impact legitimate streaming; (4) Monitor RTSP service logs for repeated authentication failures and alert on anomalies; (5) Configure automatic camera reboot on a regular schedule (e.g., nightly) to clear any persistent authentication failure state. Note that none of these controls address the root cause; they reduce attack surface and likelihood rather than eliminating the vulnerability. Refer to the MERCURY support documentation or contact the vendor's security team for availability of vendor advisory and patch information.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today