EUVD-2026-25902Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
AV corrected to Adjacent (RTSP is a network service, not local-only); PR:H retained per authenticated-attacker requirement; A:H for full stream disruption; C/I remain N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A handling issue in the RTSP service of the Mercury MIPC252W 1.0.5 Build 230306 Rel.79931n allows an authenticated attacker to trigger session termination by repeatedly sending SETUP requests for the same media track within a single RTSP session. This causes the server to reset the RTSP connection, leading to a denial-of-service condition.
AnalysisAI
Denial-of-service in the Mercury MIPC252W IP camera's RTSP service allows an authenticated attacker to crash streaming sessions by repeatedly issuing SETUP requests for the same media track within a single RTSP session, forcing the server to reset the connection and rendering the camera's video stream unavailable. The vulnerability affects firmware version 1.0.5 Build 230306 Rel.79931n specifically. Proof-of-concept code is publicly available on GitHub per SSVC data, though no active exploitation has been confirmed in CISA KEV.
Technical ContextAI
The Mercury MIPC252W is a consumer-grade IP camera that exposes video streams over RTSP (Real Time Streaming Protocol, RFC 2326), a network control protocol where SETUP requests negotiate individual media track parameters within a session. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause: the firmware's RTSP server fails to guard against redundant SETUP requests targeting an already-negotiated media track within the same session, causing uncontrolled session-state corruption or resource exhaustion that forces a connection reset. The CPE data provided (cpe:2.3:a:n/a:n/a) is uninformative and does not enumerate a vendor-specific CPE string for this device, which limits automated asset-inventory matching. Notably, the NVD-assigned CVSS vector uses AV:L (Local), which is technically inconsistent with RTSP being a network-accessible service - this is likely a vendor or NVD scoring error and is flagged explicitly in the risk assessment below.
RemediationAI
No vendor-released patch has been identified at the time of analysis; no official Mercury or TP-Link advisory is listed in the references. The sole reference is a GitHub-hosted proof-of-concept repository (https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_2th/README.md) which does not provide a patch. Until a firmware update is released by the vendor, the following compensating controls are recommended: restrict RTSP port access (typically TCP 554) to specific trusted IP addresses using firewall or ACL rules, isolating the camera on a dedicated VLAN to prevent lateral access from untrusted network segments, and rotating RTSP authentication credentials to minimize the population of users who could trigger the condition. Disabling RTSP entirely and relying on alternative streaming protocols (where supported by the device) removes the attack surface at the cost of losing RTSP-dependent integrations. Monitor for firmware updates from Mercury or its parent brand TP-Link and apply as soon as available.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today