EUVD-2026-25904Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the Authorization header contains an empty or invalid response value, as long as the nonce and session identifier correspond to a previously authenticated session. This allows an attacker with network access to reuse session parameters and issue unauthorized RTSP control commands without computing a valid Digest response.
AnalysisAI
Authentication bypass in MERCURY MIPC252W IP camera 1.0.5 allows remote unauthenticated attackers to hijack authenticated RTSP sessions and execute unauthorized camera control commands. After an initial valid Digest authentication in a DESCRIBE request, the device fails to validate subsequent RTSP request credentials (SETUP, PLAY, TEARDOWN), accepting empty or invalid Authorization headers as long as session parameters match. This enables complete camera takeover including video stream access, configuration changes, and service disruption without credential brute-forcing. EPSS score of 0.01% suggests minimal observed exploitation activity, though the attack complexity is low (AV:N/AC:L/PR:N) and public PoC exists on GitHub.
Technical ContextAI
The vulnerability stems from improper implementation of the RTSP (Real Time Streaming Protocol) Digest authentication scheme, classified as CWE-287 (Improper Authentication). RTSP typically requires Digest authentication for each method request using challenge-response with MD5 hashing of credentials, nonce, URI, and other parameters. The MERCURY MIPC252W firmware 1.0.5 Build 230306 Rel.79931n correctly validates credentials during the initial DESCRIBE handshake but fails to re-validate the 'response' parameter in the Authorization header for subsequent session operations. The device only checks session identifiers and nonce values, creating a session fixation vulnerability where an attacker monitoring network traffic can extract these non-secret parameters from legitimate sessions and replay them with fabricated Authorization headers. This represents a fundamental breakdown in stateful authentication verification within the RTSP server implementation.
RemediationAI
No vendor-released patch identified at time of analysis. MERCURY has not published a security advisory or firmware update addressing CVE-2026-35903 based on available references. Organizations should implement immediate compensating controls: isolate affected cameras on a dedicated VLAN with strict firewall rules blocking RTSP port 554 from untrusted networks; disable RTSP streaming if not operationally required and use alternative access methods (HTTPS web interface, proprietary protocols); implement network access control (802.1X) to prevent unauthorized devices from capturing session traffic; deploy TLS/encrypted tunnels (VPN) for all camera management traffic to prevent session parameter interception; monitor RTSP connection logs for anomalous session patterns (multiple IPs using same session ID, rapid succession of SETUP requests). Note that disabling RTSP eliminates streaming functionality used by third-party NVR systems and may require infrastructure changes. VLANing requires careful planning to maintain legitimate access from monitoring stations. Contact MERCURY technical support to request patched firmware and inquire about product end-of-life status. Consider hardware replacement if vendor support is discontinued.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today