Description
A handling issue in the RTSP service of the Mercury MIPC252W 1.0.5 Build 230306 Rel.79931n allows an authenticated attacker to trigger session termination by repeatedly sending SETUP requests for the same media track within a single RTSP session. This causes the server to reset the RTSP connection, leading to a denial-of-service condition.
Affected products
mercurycom: mipc252w firmware; mercurycom: mipc252w
References2
- github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/MERCU… ExploitThird Party Advisory
- github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/MERCU… ExploitThird Party Advisory
Metrics
- CVSS 3.1
-
4.4
MEDIUM
Score source: CNA
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 0% percentile: 16 · as of 13 November 2026
- CWE
- CWE-400
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.