RTSP Parser Denial of Service in MERCURY MIPC252W

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-51599 is a vulnerability in the RTSP service of the MERCURY MIPC252W IP camera. It arises because the device does not properly validate RTSP requests that include a Content-Length header but lack the corresponding message body.

According to RTSP standards (RFC 2326), certain methods like DESCRIBE, SETUP, PLAY, TEARDOWN, and OPTIONS should not have a request body, and malformed requests should be rejected with a 400 Bad Request response. However, the affected device instead enters a persistent state waiting for the body bytes that never arrive.

This causes the RTSP parser to consume all subsequent data on the same TCP connection as body content, making that connection unusable until a server-side timeout (about 20 seconds) closes it. The vulnerability can be triggered remotely without authentication by sending such malformed RTSP requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability impacts the availability of the RTSP service on the affected device by temporarily rendering an individual TCP connection unusable.

An attacker can exploit this by sending a malformed RTSP request with a Content-Length header but no body, causing the device to silently consume all subsequent data on that connection and ignore further requests until the connection times out and closes.

The impact is limited to the specific TCP connection targeted and does not affect other connections or active streaming sessions. No reboot is required for recovery, but the affected connection will be unavailable for approximately 20 seconds.

This can lead to a minor denial of service condition on the RTSP service, potentially disrupting legitimate client connections temporarily.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending an RTSP request to the MERCURY MIPC252W device's RTSP service that includes a Content-Length header but no corresponding message body. For example, sending a DESCRIBE request with a Content-Length value between 100 and 1000 but without a body will trigger the vulnerability.

You can use network tools like curl or netcat to craft such RTSP requests and observe the device's behavior. If the connection becomes unresponsive or subsequent RTSP requests on the same connection are ignored until a timeout occurs (approximately 20 seconds), the vulnerability is present.

• Example command using netcat (nc) to send a malformed RTSP request: printf 'DESCRIBE rtsp://<device-ip>/stream/1 RTSP/1.0\r\nCSeq: 1\r\nContent-Length: 150\r\n\r\n' | nc <device-ip> 554
• Monitor the connection for unresponsiveness or lack of expected RTSP responses after sending the malformed request.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding sending RTSP requests with a Content-Length header but no body to the affected device, as this triggers the vulnerability.

Since the vulnerability only affects individual TCP connections and the device recovers after a timeout (approximately 20 seconds), you can mitigate impact by closing and reopening RTSP connections if unresponsiveness is detected.

Additionally, monitor network traffic to detect and block malformed RTSP requests that could exploit this vulnerability.

Long-term mitigation would require a firmware update from the vendor to properly validate RTSP requests and reject malformed ones, but no such update is mentioned in the provided information.

Useful 0 Not Useful 0