CVE-2026-51598: MERCURY MIPC252W IP Camera RTSP DoS Vulnerability

Technical summary

CVE-2026-51598 is an input validation flaw (CWE-20) in the RTSP service of MERCURY MIPC252W IP Camera firmware v1.0.5 Build 230306. The vulnerability is triggered when the service receives a DESCRIBE request containing a malformed URL in the request line. The service lacks sufficient validation to safely parse the input, resulting in a denial of service condition. The attack requires network-adjacent access (AV:A) and no authentication (PR:N), but does not lead to confidentiality or integrity compromise. The CVSS 3.1 score of 6.5 (MEDIUM) reflects high availability impact in an isolated network context.

Business impact

IP camera outages degrade physical security monitoring and may trigger alarms or alerts to security teams, creating operational friction. Repeated DoS attacks could be used as a smokescreen for other malicious activity or as part of a multi-stage intrusion. For organizations relying on continuous video surveillance for compliance, facility access control, or incident investigation, intermittent camera unavailability introduces risk and potential liability. Recovery requires manual restart of affected devices.

Affected systems

MERCURY MIPC252W IP Camera firmware version 1.0.5 Build 230306 (Rel.79931n) is confirmed vulnerable. Other firmware versions and related MERCURY camera models have not been specified in available advisories. Organizations should verify their device model and firmware version against official MERCURY security bulletins to confirm exposure.

Exploitability

Exploitability is straightforward for an attacker with network access to the camera. The attack requires no authentication and minimal sophistication—a malformed RTSP DESCRIBE request can be crafted with basic knowledge of the protocol. However, the attacker must be on the same network segment (AV:A) as the camera, limiting exposure in well-segmented environments. There is no evidence of active exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Apply the latest firmware patch from MERCURY as soon as it is available. Until patching is possible, isolate vulnerable cameras on a dedicated VLAN with strict ingress controls and monitor RTSP traffic for anomalous requests. In defense-in-depth strategies, firewalls or network access controls can restrict RTSP (port 554) to only authorized administrators and camera management systems. Physical camera placement and network segmentation are the most effective interim mitigations for network-adjacent attack scenarios.

Patch guidance

Check the MERCURY support portal or contact MERCURY directly for the latest firmware release addressing CVE-2026-51598. Firmware updates for IP cameras typically require the device to be rebooted; schedule updates during low-activity periods to minimize surveillance gaps. Verify the new build number and release tag match official advisories before deployment. If a patch is not yet available, continue with network isolation and monitoring as detailed in the remediation summary.

Detection guidance

Monitor RTSP traffic to the camera for DESCRIBE requests with unusual or malformed URL patterns. Endpoint detection on the camera itself (if supported) may log service crashes or restarts that could indicate exploitation attempts. Network IDS/IPS signatures may detect malformed RTSP requests; consult your vendor's threat intelligence feeds for signatures specific to this CVE. Monitor camera uptime and automatically alert on unexpected reboots or loss of connectivity. Log RTSP authentication attempts and access patterns for forensic review.

Why prioritize this

Although rated MEDIUM severity, this vulnerability should be prioritized in environments where camera availability is critical to operations or compliance. The low attack complexity and lack of authentication requirements make it easy to exploit if an attacker reaches the network segment. Prioritize patching if cameras are internet-accessible, poorly segmented, or in high-security facilities. Lower priority in air-gapped or heavily restricted environments, but still address within a standard patching cycle.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects the availability impact (A:H) balanced against the attack vector limitation (AV:A). The score does not account for business context; organizations with strict surveillance requirements or internet-exposed cameras should treat this as higher risk internally. The lack of confidentiality or integrity impact (C:N, I:N) prevents a higher rating, but the ease of exploitation and lack of prerequisites (PR:N, UI:N, AC:L) elevate the score within the MEDIUM band.

Frequently asked questions