CVE-2026-51599 Details

A denial-of-service vulnerability has been identified in the RTSP service of the MERCURY MIPC252W IP camera, specifically in firmware version 1.0.5 Build 230306 Rel.79931n. The vulnerability arises from inadequate input validation in the RTSP parser, which fails to properly handle requests that include a Content-Length header without a corresponding message body. This flaw allows an unauthenticated remote attacker to disrupt an individual TCP connection by sending a malformed RTSP request. Instead of rejecting the request, the parser enters a body-waiting state, causing all subsequent data on the connection to be silently consumed as body content. This behavior renders the connection temporarily unusable, until a server-side timeout closes it, while other concurrent connections and video streaming sessions remain unaffected.