EUVD-2026-42642
GHSA-c38f-3577-frmw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated RTSP request (AV:N/AC:L/PR:N/UI:N) but impact is limited to temporary loss of a single connection, so A:L and no C/I impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding message body. The affected RTSP parser enters a body-waiting state instead of rejecting the malformed request, causing all subsequent data on the connection to be silently consumed as body content until a server-side timeout closes the connection.
AnalysisAI
Temporary connection denial-of-service in the RTSP service of the MERCURY MIPC252W IP camera (firmware v1.0.5 Build 230306 Rel.79931n) lets an unauthenticated remote attacker wedge an individual TCP connection by sending an RTSP request that declares a Content-Length but includes no message body. The malformed parser enters a body-waiting state and silently swallows all further data on that socket until a server-side timeout closes it. Despite an NVD CVSS of 9.8 and an 'Information Disclosure' tag, the described behavior is a single-connection availability nuisance with no confidentiality or integrity impact; no public exploit is identified at time of analysis and EPSS is low at 0.18% (8th percentile).
Technical ContextAI
The affected component is the RTSP (Real Time Streaming Protocol) server embedded in the MERCURY MIPC252W consumer surveillance camera. RTSP borrows HTTP-style message framing, where a Content-Length header tells the parser how many bytes of message body to read. The root cause is CWE-20 (Improper Input Validation): when a request advertises a Content-Length but supplies no body, a correctly hardened parser should reject or time out the malformed request promptly, but this implementation transitions into a body-waiting state and treats every subsequent byte on the connection as body content. That state persists until the server's own idle/read timeout fires and tears down the socket. MERCURY is a value/consumer sub-brand associated with TP-Link, and MIPC-series devices are small IoT cameras, so this is embedded firmware rather than a general-purpose server stack.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed firmware version is cited in the available data, so an exact upgrade target cannot be given. As compensating controls, restrict network reachability of the camera's RTSP service (typically TCP port 554): place the device on an isolated VLAN or IoT segment and block inbound RTSP from untrusted networks and the internet, allowing it only from your specific NVR or viewing hosts - the trade-off is that remote/off-LAN viewing must then go through a VPN or authenticated proxy. If RTSP streaming is not used, disable the RTSP service in the camera settings to remove the exposure entirely at the cost of losing standards-based streaming to third-party clients. Monitor for a firmware update from MERCURY/TP-Link and apply it once a patched build is published; reference the report at https://github.com/kkkk2222874/cve_ID_report/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_7th/README.md and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-51599. Because impact is limited to a single self-recovering connection, aggressive mitigation is generally unwarranted.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today