CVE-2026-35903: MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP…
CVE-2026-35903 · Severity: critical · CVSS 9.8 · Published 2026-04-27
MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the Authorization header contains an empty or invalid response value, as long as the nonce and session identifier correspond to a previously authenticated session. This allows an attacker with network access to reuse session parameters and issue unauthorized RTSP control commands without computing a valid Digest response.
No. Junglewise Threat Intelligence has no report of CVE-2026-35903 being exploited in the wild.
How severe is CVE-2026-35903?
Critical severity, with a CVSS score of 9.8, published 27 April 2026.
Which products and versions are affected?
Mercurycom Mipc252w, Mercurycom Mipc252w Firmware. The advisory does not name versions.
Is there a fix for CVE-2026-35903?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-35903?
Check whether you run Mercurycom Mipc252w or Mercurycom Mipc252w Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.