CVE-2026-35903General(mercurycom / mipc252w)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the Authorization header contains an empty or invalid response value, as long as the nonce and session identifier correspond to a previously authenticated session. This allows an attacker with network access to reuse session parameters and issue unauthorized RTSP control commands without computing a valid Digest response.

mercurycom CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mipc252w
mipc252w_firmware

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
General: 2 classified signals
Peaked 1d ago at 1 mentions (2026-04-27); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

mercurycom

Products

mipc252wmipc252w_firmware

2 versions affected across 2 products

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

General

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Vulmon Vulnerability Feed@VulmonFeeds163d
General
CVE-2026-35903 Improper Authentication in MERCURY MIPC252W IP Camera RTS... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35903 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The post announces CVE‑2026‑35903, an improper authentication flaw in a MERCURY IP camera, and links to detail pages but offers no PoC, exploit code, patch information, or evidence of active exploitation.
0000060
4.0K followersView on X
CVE@CVEnew163d
General
CVE-2026-35903 MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication… https://www.cve.org/CVERecord?id=CVE-2026-35903
Post summary
The post announces CVE-2026-35903 as an improper authentication vulnerability affecting the RTSP service of the MERCURY MIPC252W IP camera, without providing details on exploitation, patches, or active attacks.
00000125
57.3K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	mercurycom	mipc252w	-	-	-
OS	mercurycom	mipc252w_firmware	1.0.5	-	-

Explore more

Back to dashboard mercurycom CVEs mipc252w vulnerabilities