CVE-2026-51598 Details

A denial-of-service vulnerability has been identified in the RTSP service of the MERCURY MIPC252W IP Camera, specifically in version 1.0.5 Build 230306 Rel.79931n. The vulnerability arises from improper input validation in the RTSP DESCRIBE requests, allowing an unauthenticated, network-adjacent attacker to disrupt the camera's RTSP state machine and cause an IP-level authentication lockout. The issue occurs when the camera fails to adequately validate the URL in the DESCRIBE request line, allowing malformed URLs to bypass initial parsing and enter the authentication process. This flaw leads to two main consequences: immediate corruption of the RTSP state machine, requiring a new connection to restore normal operation, and an abnormal accumulation of authentication failure counts that can lock out the source IP from RTSP authentication for an extended period, disrupting video streaming and camera accessibility for legitimate users.