Executive brief
The MERCURY MIPC252W IP camera, used for video surveillance, contains a security flaw in how it handles user logins for video streaming. Because the device does not properly expire temporary security tokens used during the login process, an attacker on the same local network can record a legitimate user's login and reuse it later. This allows the attacker to bypass security and view the camera's live video feed without ever knowing the actual password.
Technical details
A replay attack vulnerability (CWE-294) exists in the RTSP service of the MERCURY MIPC252W IP camera due to the lack of nonce expiration or invalidation in Digest authentication. Contrary to RFC 2617 recommendations, the device accepts nonce and response pairs indefinitely; testing confirmed that credentials captured three days prior remained valid. An attacker on the same network segment can capture a legitimate RTSP DESCRIBE request, extract the nonce and response values, and replay them in a new connection. This allows the attacker to bypass authentication and access the live video stream without knowledge of the device's plaintext credentials.
Affected products
- MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n
Timeline
- 2026-07-09: disclosed: Initial disclosure via GitHub and NVD publication