Auth bypass in Mercurycom Mipc252w
CVE-2026-35903
MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the Authorization header contains an empty or invalid response value, as long as the nonce and session identifier correspond to a previously authenticated session. This allows an attacker with network access to reuse session parameters and issue unauthorized RTSP control commands without computing a valid Digest response.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (49.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.002
Affected products
- Mercurycom Mipc252w
- Mercurycom Mipc252w Firmware — versions 1.0.5
Weakness classification (CWE)
References
- github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/MERCURY_MIPC252W/MERC… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-35903?
- CVE-2026-35903 is a critical-severity vulnerability in Mercurycom Mipc252w, classified under Improper Authentication. CVSS score: 9.8/10. Published 2026-04-27.
- How severe is CVE-2026-35903?
- Critical severity. CVSS v3 base score is 9.8 out of 10.