CVE-2026-35901: A handling issue in the RTSP service of the Mercury MIPC252W 1.0.5 Build 230306 Rel.79931n allows an authenticated…
CVE-2026-35901 · Severity: medium · CVSS 4.4 · Published 2026-04-27
A handling issue in the RTSP service of the Mercury MIPC252W 1.0.5 Build 230306 Rel.79931n allows an authenticated attacker to trigger session termination by repeatedly sending SETUP requests for the same media track within a single RTSP session. This causes the server to reset the RTSP connection, leading to a denial-of-service condition.
No. Junglewise Threat Intelligence has no report of CVE-2026-35901 being exploited in the wild.
How severe is CVE-2026-35901?
Medium severity, with a CVSS score of 4.4, published 27 April 2026.
Which products and versions are affected?
Mercurycom Mipc252w, Mercurycom Mipc252w Firmware. The advisory does not name versions.
Is there a fix for CVE-2026-35901?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-35901?
Check whether you run Mercurycom Mipc252w or Mercurycom Mipc252w Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.