{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-35902", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-28T12:52:39.002Z", "dateReserved": "2026-04-06T00:00:00.000Z", "datePublished": "2026-04-27T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-27T18:35:33.091Z"}, "descriptions": [{"lang": "en", "value": "The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts. By repeatedly sending RTSP requests with invalid authentication parameters, an unauthenticated attacker can cause the RTSP service to enter a persistent authentication failure state, preventing legitimate clients from authenticating and leading to a denial of service."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_3th/README.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-307", "lang": "en", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "references": [{"url": "https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_3th/README.md", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-28T12:52:33.239510Z", "id": "CVE-2026-35902", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T12:52:39.002Z"}}]}, "dataVersion": "5.2"}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts. By repeatedly sending RTSP requests with invalid authentication parameters, an unauthenticated attacker can cause the RTSP service to enter a persistent authentication failure state, preventing legitimate clients from authenticating and leading to a denial of service."}], "id": "CVE-2026-35902", "lastModified": "2026-04-28T14:16:12.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-27T19:16:51.060", "references": [{"source": "cve@mitre.org", "url": "https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_3th/README.md"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_3th/README.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.0.5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "mipc252w", "vendor": "mercury"}], "analysis": {"en": {"generated_at": "2026-04-28T13:16:07.841310+00:00", "value": {"mitigation_remediation": ["Upgrade the camera firmware to the latest version that addresses the persistent authentication failure bug.", "Restrict access to the RTSP service to trusted IP ranges by configuring firewall rules or network segmentation.", "Monitor the RTSP service for authentication failure states and restart the camera or apply rate\u2011limiting via a firewall or IDS to prevent repeated invalid authentication attempts."], "summary": {"action": "Patch or Mitigate", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Only the MERCURY IP camera model MIPC252W, firmware version 1.0.5 Build 230306, has been found to be vulnerable. No other vendors or products were listed.", "description_and_impact": "The RTSP service in the MERCURY MIPC252W camera mishandles failed Digest authentication attempts. By repeatedly sending RTSP requests with invalid authentication parameters, an attacker can force the service into a persistent authentication failure state, blocking legitimate clients from authenticating and disrupting normal operation.", "risk_and_exploitability": "No CVSS score is available and the EPSS score is not disclosed; the vulnerability is not listed in the CISA KEV catalog. The attack requires network access to the RTSP interface, which is typically exposed on port 554. Because authentication is not required for an initial request, an unauthenticated attacker can easily reach the target. The exploit would cause a denial of service that could affect surveillance coverage but does not expose data or compromise system integrity. The risk is therefore significant for deployed cameras that are accessible from untrusted networks, particularly if no controls limit traffic to the RTSP endpoint."}}}}, "created": "2026-04-28T09:17:29.552649+00:00", "title": "Denial of Service via Persistent Authentication Failure in MIPC252W RTSP Service", "updated": "2026-04-28T13:30:32.081820+00:00", "vendors": ["mercury", "mercury$PRODUCT$mipc252w"], "weaknesses": ["CWE-519", "CWE-770"]}