EUVD-2026-42640
GHSA-c8j5-2w73-cw74
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Adjacent access per description (AV:A) and dependence on capturing a real authentication exchange raises complexity (AC:H); impact is stream disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials, gaining unauthorized access to the live video stream.
AnalysisAI
Authentication bypass in the MERCURY MIPC252W IP camera (firmware v1.0.5 Build 230306 Rel.79931n) lets an attacker on the same local network replay a captured RTSP Digest authentication exchange to view the live video feed without knowing the device credentials. The root cause is that the RTSP server never expires or invalidates authentication nonces, so a sniffed nonce/response pair remains valid on new connections indefinitely. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the barrier to abuse is minimal for anyone already positioned on the LAN.
Technical ContextAI
The vulnerability lives in the camera's RTSP (Real Time Streaming Protocol) service, which uses HTTP-style Digest Access Authentication (RFC 2617/7616) to gate access to the live stream. Digest auth is designed to resist replay by issuing a server-generated one-time 'nonce' that the client hashes together with the credentials; correct implementations expire nonces after a short window or a single use. Here the device fails to enforce any nonce lifetime or single-use property, so the response hash tied to a given nonce stays valid across sessions. This maps to CWE-294 (Authentication Bypass by Capture-replay): the secret is never transmitted, but because the challenge is static/reusable, capturing one valid response is equivalent to holding the credential for stream access. The affected asset is the embedded RTSP daemon on the MIPC252W camera; MERCURY is a consumer/SOHO sub-brand associated with TP-Link, so the codebase is typical low-cost embedded camera firmware.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation relies on compensating controls. Isolate the camera on a dedicated VLAN or guest Wi-Fi segment that untrusted devices cannot reach, since the attack requires the adversary to be on the same adjacent network to sniff and replay the RTSP exchange - this is the single most effective mitigation and has the side effect of also blocking legitimate LAN clients unless firewall rules explicitly permit the NVR/viewer. Restrict access to the RTSP port (typically TCP 554) at the switch/router to only the specific NVR or viewing host IPs, accepting that ad-hoc mobile viewing on the LAN will break. Where the camera supports it, disable RTSP entirely if the vendor app uses a separate (non-vulnerable) channel, or place the stream behind a VPN so no plaintext Digest exchange traverses shared media. Monitor the vendor/TP-Link/MERCURY support portal and the referenced research report for a firmware update and apply it once released; wired connections should be preferred over Wi-Fi to reduce passive sniffing exposure.
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today