TI-2026-27789 Aliases CVE-2026-35903 GHSA-qcq4-vpjf-wxhh

MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper…

HIGH 82CWE-287Published 2026-04-27 · Updated 2026-04-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.

Summary

MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the Authorization header contains an empty or invalid response value, as long as the nonce and session identifier correspond to a previously authenticated session. This allows an attacker with network access to reuse session parameters and issue unauthorized RTSP control commands without computing a valid Digest response.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00487 42nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:mercurycom:mipc252w_firmware:1.0.5:build_230306::::::	1.0.5 build_230306	Vulnerable	Mercurycom
cpe:2.3:h:mercurycom:mipc252w:-:::::::*	not specified by NVD	Running on	Mercurycom

cpe:2.3:o:mercurycom:mipc252w_firmware:1.0.5:build_230306:*:*:*:*:*:* Versions 1.0.5 build_230306 Vulnerable ·Mercurycom
cpe:2.3:h:mercurycom:mipc252w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mercurycom

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-35903
2026-10-03 Alias added: GHSA-qcq4-vpjf-wxhh
2026-10-18 EPSS moved to the 50th–90th percentile
2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_4th/README.md

TI-2026-23917 A null pointer dereference vulnerability exists in the RTSP service of the MERCURY… CVSS 3.1HIGH 7.5
TI-2026-27788 The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling… CVSS 3.1MEDIUM 6.2
TI-2026-27787 A handling issue in the RTSP service of the Mercury MIPC252W 1.0.5 Build 230306… CVSS 3.1MEDIUM 4.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences