Security readout for executives and security teams
Plain-English summary
This vulnerability affects the MERCURY MIPC252W IP camera firmware v1.0.5 Build 230306 Rel.79931n. The camera’s RTSP Digest authentication reportedly reuses authentication material without expiring it. An attacker who can observe a valid login exchange on the network may replay it to access the live video stream without knowing the password.
Executive priority
Treat as high priority for physical security and privacy environments using this camera model. The issue can allow unauthorized live video access if an attacker can observe authentication traffic. Prioritize segmentation and vendor update checks, especially in sites with shared or weakly controlled networks.
Technical view
CVE-2026-51597 is described as CWE-294, authentication bypass by capture-replay. The RTSP Digest nonce does not expire, allowing replay of captured nonce and response values in a new RTSP connection. The CVSS 3.1 score is 9.1. Public details identify MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n.
Likely exposure
Exposure is most relevant where these cameras are deployed on networks where an attacker can observe RTSP authentication traffic. Internet exposure is not specifically documented in the provided sources. Organizations should prioritize cameras on shared, poorly segmented, wireless, or untrusted local networks.
Exploitation context
The provided record does not indicate CISA KEV listing or confirmed active exploitation. The public description says exploitation requires capturing a legitimate authentication exchange and replaying values to bypass authentication. No weaponized public exploit status is established by the supplied sources.
Researcher notes
Evidence is limited to the CVE record and a public GitHub report. The CVSS vector lists network attack complexity, while the narrative emphasizes an adjacent observer capturing authentication. No patch, workaround, or vendor advisory is included in the supplied sources.
Mitigation direction
- Check MERCURY/vendor guidance for updated firmware or configuration advisories.
- Restrict RTSP access to trusted management or monitoring hosts only.
- Segment IP cameras from user and guest networks.
- Disable RTSP if not required for business operations.
- Rotate camera credentials after network exposure is reduced.
Validation and detection
- Inventory MERCURY MIPC252W cameras and record firmware build numbers.
- Identify systems exposing RTSP and their reachable network segments.
- Review network design for untrusted access to camera RTSP traffic.
- Check vendor or CVE sources for firmware updates and advisory changes.
- Monitor camera logs for unexpected RTSP sessions where logging is available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-294: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-51597 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/kkkk2222874/cve_ID_report/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_5th/README.mdCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.