CVE-2026-51597 | THREATINT

Description

MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials, gaining unauthorized access to the live video stream.

PUBLISHED Reserved 2026-06-08 | Published 2026-07-09 | Updated 2026-07-10 | Assigner mitre

References

github.com/...ERCURY_MIPC252W/MERCURY_MIPC252W_5th/README.md exploit

github.com/...ERCURY_MIPC252W/MERCURY_MIPC252W_5th/README.md

cve.org (CVE-2026-51597)

nvd.nist.gov (CVE-2026-51597)

Download JSON