ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-35903

MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service.

Published Apr 27, 2026 · catalog updated Jun 17, 2026 · mipc252w firmware

Check if you run it

No confirmed exploitation is on record for CVE-2026-35903. EPSS is 0.65%. Act only if a listed version of mipc252w firmware is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical9.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.65%
Remediation
Not established
Affected products
cpe mercurycom/mipc252w firmware

MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the Authorization header contains an empty or invalid response value, as long as the nonce and session identifier correspond to a previously authenticated session. This allows an attacker with network access to reuse session parameters and issue unauthorized RTSP control commands without computing a valid Digest response.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe mercurycom/mipc252w firmware1.0.5

How to fix CVE-2026-35903

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-35903. EPSS is 0.65%. Act only if a listed version of mipc252w firmware is installed.

Which versions are affected?

Compare what you have installed with mercurycom/mipc252w firmware 1.0.5. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-287: Improper Authentication. EPSS 0.65%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 27, 2026 · NIST NVD

    Detected

    MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the

  2. Jun 17, 2026 · NIST NVD

    Updated

    MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the

Sources

  • CVE.orgVulnerability recordCVE-2026-35903

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-35903

    30-day exploitation probability 0.6%

    first.org
  • NIST NVDVulnerability recordCVE-2026-35903

    MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP reque

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.