MERCURY MIPC252W CVE-2026-35902

Upgrade MERCURY MIPC252W firmware to a patched version if available from MERCURY; contact the vendor for guidance on available firmware updates and timelines. If a patched version is not available, implement the following compensating controls: (1) Restrict RTSP port 554 access at the network firewall to only authorized IP addresses or network segments - this eliminates remote exploitation but does not prevent local network attacks; (2) Isolate the camera on a separate VLAN or network segment, restricting access from untrusted devices or users; (3) Implement network-based rate limiting on RTSP requests to the camera to slow brute-force authentication attempts, though this may impact legitimate streaming; (4) Monitor RTSP service logs for repeated authentication failures and alert on anomalies; (5) Configure automatic camera reboot on a regular schedule (e.g., nightly) to clear any persistent authentication failure state. Note that none of these controls address the root cause; they reduce attack surface and likelihood rather than eliminating the vulnerability. Refer to the MERCURY support documentation or contact the vendor's security team for availability of vendor advisory and patch information.