CVE-2026-35901: Mercury MIPC252W RTSP DoS Vulnerability

CVE-2026-35901 Overview

A handling issue exists in the RTSP (Real Time Streaming Protocol) service of the Mercury MIPC252W IP camera running firmware version 1.0.5 Build 230306 Rel.79931n. This vulnerability allows an authenticated attacker to trigger session termination by repeatedly sending SETUP requests for the same media track within a single RTSP session. The improper handling of these duplicate requests causes the server to reset the RTSP connection, resulting in a denial-of-service condition that disrupts video streaming capabilities.

Critical Impact

Authenticated attackers can repeatedly crash RTSP sessions on Mercury MIPC252W cameras, disrupting video surveillance and streaming functionality for legitimate users.

Affected Products

• Mercury MIPC252W IP Camera
• Firmware version 1.0.5 Build 230306 Rel.79931n

Discovery Timeline

• 2026-04-27 - CVE-2026-35901 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-35901

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), which manifests in the RTSP service's inability to properly handle repeated SETUP requests targeting the same media track within an active session. The RTSP protocol is commonly used for establishing and controlling media sessions for streaming video from IP cameras and surveillance devices.

When an authenticated user sends multiple SETUP requests for an identical media track without proper session management, the RTSP service fails to gracefully handle this condition. Instead of rejecting duplicate requests or managing them appropriately, the service enters an error state that causes the entire RTSP connection to reset. This design flaw allows malicious authenticated users to intentionally disrupt streaming sessions.

The vulnerability requires local access and high privileges to exploit, limiting the attack surface. However, in environments where multiple users have authenticated access to camera streams, this vulnerability could be abused to deny service to other legitimate users or disrupt security monitoring operations.

Root Cause

The root cause stems from inadequate request validation and session state management within the RTSP service implementation. The service lacks proper handling logic for scenarios where a client sends duplicate SETUP requests for media tracks that have already been configured within the same session. Rather than maintaining session stability by ignoring or properly rejecting redundant requests, the service attempts to reconfigure the track, leading to resource conflicts that trigger a connection reset.

Attack Vector

The attack requires authenticated access to the RTSP service and is executed locally. An attacker with valid credentials can establish an RTSP session and then deliberately send repeated SETUP requests for the same media track (such as video or audio streams). Each duplicate SETUP request triggers the vulnerability condition, causing the server to reset the connection.

The attack sequence involves:

1. Authenticating to the RTSP service on the Mercury MIPC252W camera
2. Initiating an RTSP session using the DESCRIBE method
3. Sending a SETUP request for a specific media track
4. Repeatedly sending additional SETUP requests for the same track
5. Observing the server reset the connection due to improper state handling

For technical details and proof-of-concept information, refer to the CVE reference documentation on GitHub.

Detection Methods for CVE-2026-35901

Indicators of Compromise

• Repeated RTSP SETUP requests from the same authenticated session targeting identical media tracks
• Unusual frequency of RTSP connection resets or session terminations
• Log entries indicating multiple track configuration attempts within short time intervals
• Service availability interruptions affecting video streaming functionality

Detection Strategies

• Monitor RTSP service logs for patterns of repeated SETUP requests from individual sessions
• Implement rate limiting detection for RTSP commands from authenticated users
• Configure alerts for abnormal session termination rates on camera devices
• Deploy network monitoring to identify unusual RTSP traffic patterns targeting surveillance infrastructure

Monitoring Recommendations

• Enable verbose logging on Mercury MIPC252W devices to capture RTSP session details
• Implement network-based monitoring for RTSP protocol anomalies on port 554
• Establish baseline metrics for normal RTSP session behavior to identify deviations
• Monitor camera availability and streaming uptime for unexpected interruptions

How to Mitigate CVE-2026-35901

Immediate Actions Required

• Review and restrict authenticated access to RTSP services on affected Mercury MIPC252W cameras
• Implement network segmentation to limit who can reach camera RTSP services
• Monitor for exploitation attempts by tracking RTSP session patterns
• Consider temporarily disabling RTSP access if not operationally required until a patch is available

Patch Information

At the time of publication, no vendor patch has been announced for this vulnerability. Organizations should monitor Mercury/TP-Link security advisories for firmware updates addressing this issue. Check the GitHub CVE reference for updates on remediation status.

Workarounds

• Restrict RTSP service access to only trusted users and networks through firewall rules
• Implement network-level rate limiting for RTSP connections to affected devices
• Deploy cameras behind a VPN or jump server to add authentication layers
• Consider using alternative streaming protocols if supported by the device
• Enable authentication logging to track and audit RTSP access attempts

# Example: Restrict RTSP access using iptables (adjust IP ranges as needed)
# Allow RTSP (port 554) only from trusted management network
iptables -A INPUT -p tcp --dport 554 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 554 -j DROP

# Rate limit RTSP connections per source IP
iptables -A INPUT -p tcp --dport 554 -m connlimit --connlimit-above 5 -j REJECT