CVE-2026-35903 Details

An improper authentication vulnerability has been identified in the MERCURY MIPC252W IP camera, specifically in the RTSP service of firmware version 1.0.5 Build 230306 Rel.79931n. After a successful Digest authentication during an initial DESCRIBE request, the camera fails to verify the Digest response parameter in subsequent RTSP requests within the same session. This oversight allows RTSP methods such as SETUP, PLAY, and TEARDOWN to be executed, even when the Authorization header contains an empty or invalid response value, as long as the nonce and session identifier match those of a previously authenticated session. Consequently, an attacker with network access can reuse session parameters to issue unauthorized RTSP control commands without generating a valid Digest response.