What is the CVSS score of CVE-2026-51598?

CVE-2026-51598 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

MERCURY MIPC252W CVE-2026-51598

EUVD-2026-42641 MEDIUM

Improper Input Validation (CWE-20)

2026-07-09 cve@mitre.org

GHSA-g3rw-v45p-h99c

Denial Of Service

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

AV:A confirmed by adjacent-only RTSP exposure; PR:N as no auth required; A:H for service crash causing full stream loss; C/I:N as no data exposure occurs.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 19:31 vuln.today

CVSS changed

Jul 09, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jul 09, 2026 - 17:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent attacker to cause a denial of service via a crafted DESCRIBE request with a malformed URL in the request line.

AnalysisAI

Denial of service in the RTSP service of MERCURY MIPC252W IP Camera firmware v1.0.5 Build 230306 Rel.79931n allows an unauthenticated, network-adjacent attacker to crash the streaming service by sending a crafted DESCRIBE request containing a malformed URL in the request line. The root cause is improper input validation (CWE-20) in the RTSP parser, resulting in complete loss of camera availability until the device is rebooted. Publicly available exploit code exists per SSVC classification, though no confirmed active exploitation (CISA KEV) has been recorded.

Technical ContextAI

The RTSP (Real Time Streaming Protocol, RFC 2326) service is the core streaming interface embedded in the MERCURY MIPC252W IP camera firmware. The DESCRIBE method in RTSP initiates session negotiation by requesting media resource parameters; its request line contains a URL identifying the resource. CWE-20 (Improper Input Validation) indicates the firmware's RTSP parser does not adequately validate the URL field in incoming DESCRIBE requests, causing a crash or resource exhaustion when a malformed URL is processed. MERCURY is a consumer/SOHO IP camera brand; no CPE string was included in the source data, and the affected version is identified solely from the CVE description as v1.0.5 Build 230306 Rel.79931n. Whether earlier or later firmware builds share this defect is not confirmed.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary compensating control is to restrict network access to the camera's RTSP service (default TCP port 554) via firewall or access-control list rules, preventing adjacent-network attackers from delivering crafted DESCRIBE requests; the trade-off is that legitimate remote RTSP viewing clients will also be blocked. Placing the camera on an isolated IoT VLAN with no cross-VLAN routing limits the attacker pool to only devices on that segment, significantly reducing exposure without disabling functionality. If RTSP streaming is not operationally required, disabling the RTSP service in the camera's configuration eliminates the attack surface entirely but removes the primary live-stream capability. Organizations should monitor the GitHub reference and any future MERCURY vendor bulletins for patch release. The referenced report is at https://github.com/kkkk2222874/cve_ID_report/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_6th/README.md.