CVE-2026-35901

Executive Summary

CVE-2026-35901 is a denial-of-service (DoS) vulnerability in the RTSP (Real Time Streaming Protocol) service of the Mercury MIPC252W IP camera, specifically affecting firmware version 1.0.5 Build 230306 Rel.79931n. An authenticated attacker can exploit a handling flaw that triggers session termination by repeatedly sending SETUP requests for the same media track within a single RTSP session, causing the server to reset the connection and rendering the device unavailable. The vulnerability carries a CVSS score of 4.4 (Medium severity) and currently has no patch available from the vendor — the device remains exposed to exploitation with a 0/4 patch confidence rating.

Technical Analysis

The Mercury MIPC252W is an entry-level IP camera commonly deployed in small offices, retail environments, and residential monitoring setups. The device exposes an RTSP service on TCP port 554 (default) for video streaming, which handles session control messages per RFC 2326. The vulnerability resides in the RTSP server's session state management logic.

Vulnerability Mechanism

The RTSP protocol defines a session lifecycle: a client sends SETUP to initialize transport parameters for a media track, followed by PLAY to initiate streaming, and TEARDOWN to terminate. The server maintains per-session state, including a list of configured media tracks (typically trackID=0 for video and trackID=1 for audio on such devices).

The flaw manifests when the server receives multiple SETUP requests referencing the same media track within one active RTSP session. Instead of returning an error (455 Method Not Valid in This State per RFC 2326) or idempotently re-acknowledging the existing track configuration, the server mishandles the repeated track setup, corrupts its internal session state, and forcibly resets or tears down the entire RTSP connection. The attack is authenticated — the attacker must possess valid RTSP credentials (default credentials on many Mercury devices are notoriously weak, e.g., admin/admin or blank passwords).

Affected Functionality

The vulnerable code path is the SETUP request handler within the RTSP daemon. The handler likely uses a fixed-size array or hash map to store track configurations and fails to check whether a track ID has already been registered. When a duplicate registration occurs, the handler overwrites state or triggers an assertion failure that aborts the session thread, subsequently closing the TCP socket and terminating other concurrent RTSP sessions sharing the same worker process.

Attack Surface Analysis

• Network-exposed RTSP port: By default, the camera listens on 0.0.0.0:554, making it reachable from the LAN. Shodan and similar services show substantial numbers of Mercury MIPC252W cameras exposed to the internet via default UPnP port forwarding or direct public IP assignment.
• Authentication: Requires valid RTSP credentials, but default credentials on Mercury devices are widely documented and rarely changed by end users.
• Low complexity: Each SETUP request is a small, well-formed RTSP message requiring minimal bandwidth. An attacker can send hundreds of requests per second from a single host.
• No CWE-400 resource exhaustion in the traditional sense: The bug is not memory or CPU exhaustion but a logic error that crashes the session handler. Nevertheless, MITRE classifies it under CWE-400 (Uncontrolled Resource Consumption) because repeated triggering exhausts connection resources and degrades availability.

Root Cause Classification

The vulnerability class is an improper state management — specifically, a failure to validate RTSP state transitions. Similar flaws have been observed in other embedded IP camera RTSP implementations (e.g., CVE-2018-10057 in various Hikvision models), underscoring that this is a systemic issue in low-cost IoT firmware development where protocol state machines are implemented naively without robustness testing.

Exploitation Scenarios

The following attack chain describes how an attacker would exploit CVE-2026-35901 against a vulnerable Mercury MIPC252W camera.

Step 1 — Reconnaissance and Target Identification

• The attacker scans a target network or the internet for exposed RTSP services: nmap -p 554 --script rtsp-methods <subnet> or uses Shodan with dorks such as product:"MIPC252W" or port:554 "Mercury".
• The attacker identifies candidate devices and probes RTSP authentication: curl -v rtsp://<target>:554/ and inspects the 401 Unauthorized response, which confirms RTSP is active.
• Credential guessing: The attacker attempts default credentials (e.g., admin:admin, admin:123456, or blank password) via a small script that sends DESCRIBE requests with Authorization: Basic <base64>. These default credentials are statistically common on Mercury cameras.

Step 2 — Establishing RTSP Session

• Once authenticated, the attacker opens a TCP connection to port 554 and establishes an RTSP session:

  OPTIONS rtsp://<target>:554/ RTSP/1.0
  CSeq: 1
  User-Agent: VLC/3.0.18
  

• The server responds with 200 OK and a list of supported methods. The attacker then sends DESCRIBE to retrieve the media description:

  DESCRIBE rtsp://<target>:554/ RTSP/1.0
  CSeq: 2
  Accept: application/sdp
  Authorization: Basic YWRtaW46YWRtaW4=
  

• The 200 OK response includes an SDP body with two media tracks: a=control:trackID=0 (video) and a=control:trackID=1 (audio).

Step 3 — Weaponized SETUP Flood

• The attacker now sends a rapid sequence of SETUP requests, each targeting the same media track (trackID=0), within the same RTSP session (identified by the Session header issued during the first SETUP):

  SETUP rtsp://<target>:554/trackID=0 RTSP/1.0
  CSeq: 3
  Transport: RTP/AVP/TCP;unicast;interleaved=0-1
  Session: <session_id_from_first_SETUP>
  

  Immediately followed by again:

  SETUP rtsp://<target>:554/trackID=0 RTSP/1.0
  CSeq: 4
  Transport: RTP/AVP/TCP;unicast;interleaved=0-1
  Session: <session_id_from_first_SETUP>
  

• The attacker script maintains a single TCP connection and repeats the SETUP request 50–200 times within seconds. Each request is valid per RTSP grammar, so no IDS/IPS signature would flag malformed packets.
• After approximately 10–30 duplicate SETUP requests (depending on internal buffer boundaries), the server's session handler triggers the state corruption, closes the TCP socket (RST flag), and kills the RTSP worker thread.

Step 4 — Post-Exploitation Impact

• The RTSP service becomes unresponsive: subsequent legitimate connection attempts (by the camera's mobile app, an NVR, or a VLC client) time out or receive 503 Service Unavailable.
• On many single-core embedded devices, the crashed worker thread may not be automatically restarted, forcing a manual reboot or a power cycle to restore functionality. If the attack is repeated on every reboot, the device is rendered permanently DoS'd.
• Because the bug crashes the RTSP handler thread specifically, other camera functions (web UI, ONVIF, video recording to SD card) may continue operating. However, live video streaming — the primary function — is completely unavailable.
• The attacker can repeat the cycle indefinitely by reconnecting after each crash, requiring no further action beyond re-authentication (which persists via cached credentials on some firmware builds).

Persistence and Chaining

• While this specific vulnerability is a DoS only, an attacker with valid RTSP credentials can likely also exploit the same exposed management plane to attempt remote code execution via other known Mercury firmware flaws. CVE-2026-35901 can serve as a disruptor to mask other malicious activity (e.g., credential harvesting during the outage window).

Impact Assessment

CVSS Context

The vulnerability holds a CVSS score of 4.4 (Medium), reflecting a constrained but non-trivial impact:

• Attack Vector: Adjacent/Network — RTSP is network-reachable, but authentication is required, dampening the severity.
• Attack Complexity: Low — No special conditions needed; a single TCP session suffices.
• Availability Impact: High — The RTSP service is fully disrupted, and the device may require manual reboot.
• Confidentiality/Integrity Impact: None — No data exfiltration or modification.

Business Impact

• Surveillance outage: The primary function (live video streaming) is halted, creating blind spots in physical security monitoring. For retail stores or facilities that rely on this camera for loss prevention, the outage window could allow theft or safety incidents to go undocumented.
• Operational cost: Manual reboot or site visit required. For cameras installed in hard-to-reach locations (ceilings, poles), the remediation cost exceeds the device's purchase price.
• Reputational damage: For MSPs or security integrators that deployed Mercury cameras to clients, a publicly known, unpatched DoS vulnerability undermines trust and may trigger contractual breach claims.

Affected Systems and Blast Radius

• The exact affected version is Mercury MIPC252W 1.0.5 Build 230306 Rel.79931n. The vendor has not released a patch, and no subsequent firmware versions are listed as fixed. Given the vendor's release cadence for other models, it is plausible that earlier MIPC252W firmware builds share the same flawed RTSP handler, but this cannot be confirmed without vendor disclosure.
• The blast radius is limited per-device (no lateral movement), but the attack can be conducted remotely across the internet if the device is port-forwarded, amplifying the number of reachable targets.

Threat Actor Interest

The EPSS score of 0.00247 (16.1% percentile) indicates low near-term exploitation likelihood in the wild — most attackers prioritize higher-value RCE flaws. However, IoT botnets (e.g., Mirai variants) have historically incorporated simple DoS flaws into their scanning arsenals to build DDoS capacity. If weaponized, this vulnerability could become a source of carpet-bombing DoS against internet-exposed camera fleets.

Detection Guidance

Sigma Rule

The Sigma rule below detects repeated RTSP SETUP requests for the same track from a single source IP within a short time window, as logged by an RTSP-aware proxy or WAF that parses the control channel.

title: Mercury MIPC252W Repeated RTSP SETUP Requests (CVE-2026-35901)
id: 6f8c4d2e-9a1b-4c3d-8e5f-1a2b3c4d5e6f
status: experimental
description: Detects an authenticated RTSP client sending multiple SETUP requests for the same track ID within a single session, indicative of CVE-2026-35901 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35901
author: Valters IT Cyber Analysis Team
date: 2026/06/02
logsource:
    category: application
    product: rtsp_proxy
    definition: 'Requires RTSP control channel logging with request method, session ID, and track URI.'
detection:
    selection:
        rtsp_method: SETUP
    condition: selection
    timeframe: 10s
    aggregation:
        field: src_ip
        function: count
        condition: '>= 15'
        groupby:
            - rtsp_session_id
            - track_uri
level: high
falsepositives:
    - Misconfigured RTSP clients that retransmit SETUP on network timeouts
    - Poorly written NVR software performing redundant track initialization
tags:
    - attack.t1499
    - cve.2026.35901
    - cwe.400

YARA Rule

This YARA rule targets log files or packet captures that contain the byte-level pattern of an attack sequence — a burst of RTSP SETUP lines referencing the same track URI within close proximity.

rule Mercury_RTSP_SETUP_Flood_CVE_2026_35901 {
    meta:
        author = "Valters IT Cyber Analysis Team"
        description = "Detects packet captures or RTSP proxy logs containing 3+ SETUP requests for the same media track in quick succession."
        cve_id = "CVE-2026-35901"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-35901"
        date = "2026-06-02"
        severity = "medium"
    strings:
        $setup_method = "SETUP " ascii
        $track_token = "trackID=" ascii
        $rtsp_version = "RTSP/1.0" ascii
        $cseq_trigger = "CSeq: " ascii
        $session_hdr = "Session:" ascii
    condition:
        uint16(0) == 0x0d0a or filesize > 1KB and
        #setup_method >= 3 and
        #track_token >= 3 and
        #rtsp_version >= 3 and
        #cseq_trigger >= 3 and
        #session_hdr >= 1
}

Suricata IDS Rule

The Suricata rule below inspects RTSP control traffic on port 554 and flags a source IP that issues 20 or more SETUP requests within 10 seconds.

alert tcp any any -> any 554 (msg:"MERCURY MIPC252W RTSP SETUP Flood DoS Attempt (CVE-2026-35901)"; flow:established,to_server; content:"SETUP "; http_uri; content:"trackID="; http_uri; threshold:type both, track by_src, count 20, seconds 10; classtype:attempted-dos; sid:202635901; rev:1; metadata:created_at 2026_06_02, cve CVE-2026-35901, cwe CWE-400, mitre_attack T1499;)

Elastic Detection

The following EQL query detects rapid consecutive RTSP SETUP events from the same source IP and session, using a correlation over time.

sequence by source.ip, rtsp.session.id with maxspan=10s
  [ network where event.category == "network" and network.protocol == "rtsp"
        and rtsp.method == "SETUP" ]
  [ network where event.category == "network" and network.protocol == "rtsp"
        and rtsp.method == "SETUP" ] with runs=15

Splunk SPL Query

This Splunk query aggregates RTSP SETUP requests from a rtsp_proxy sourcetype and highlights IPs exceeding a threshold count per session.

index=proxy sourcetype=rtsp_logs method="SETUP"
| bin _time span=10s
| stats count as setup_count by src_ip, rtsp_session, rtsp_track
| where setup_count >= 15
| table _time, src_ip, rtsp_session, rtsp_track, setup_count
| sort - setup_count

Wazuh OSSEC Rule

The following Wazuh XML rule triggers an alert when an RTSP proxy log shows a high frequency of SETUP requests from a single source.

<group name="rtsp,">
  <rule id="274315" level="10">
    <decoded_as>rtsp_proxy</decoded_as>
    <field name="rtsp_method">SETUP</field>
    <description>Mercury MIPC252W RTSP SETUP request flood - possible CVE-2026-35901 exploitation</description>
    <group>dos, rtsp, cve-2026-35901,</group>
    <frequency>15</frequency>
    <timeframe>10</timeframe>
    <same_source_ip />
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

As of 2026-06-02, no patch evidence exists from any tracked source. The vendor (Mercury) has not released a firmware update addressing CVE-2026-35901, the Vendor Fix field is N/A, and no workarounds have been officially documented. The affected version list is empty, and no OSV package is associated. Under no circumstances should you assume a patched firmware exists.

1) Immediate Mitigations (Do these today)

• Restrict network exposure: Do not expose the RTSP port (554) to untrusted networks. Immediately disable UPnP port forwarding on the router that is forwarding 554 to the camera. Move the camera to a separate VLAN with strict firewall rules allowing only known NVR/IP addresses to reach the RTSP port.
• Change default credentials: If the camera still uses default credentials (admin/admin, admin/123456, blank password), change them immediately. While this does not fix the DoS, it prevents trivial unauthenticated-to-authenticated exploitation by opportunistic scanners.
• Deploy an application-layer RTSP proxy/firewall: Place a reverse proxy (e.g., rtsp-lite or a hardware BALANCED application delivery controller) in front of the camera that normalizes and rate-limits RTSP SETUP requests. Enforce a maximum of 5 SETUP per session per 30 seconds; reject duplicates beyond that with a 455 Method Not Valid in This State response. This breaks the attack chain at the network edge.
• Monitor and alert: Implement the Sigma/Suricata/Splunk detections above. A high volume of SETUP requests is a reliable early warning.

2) Patch/Upgrade Steps

• There is no patch to apply. Do not waste time searching vendor download portals for a phantom build. Instead:
• Subscribe to Mercury's firmware notification channel (if any) and join security mailing lists that track IoT CVE disclosures.
• Set a recurring calendar reminder (e.g., monthly) to re-check mercurycom.com.cn or the regional distributor for a firmware update. If the vendor releases a new build, verify the changelog explicitly references CVE-2026-35901 before deploying. Test the firmware on a staging camera and verify that the RTSP SETUP flood no longer crashes the service.
• If no patch appears within 90 days, replacement planning should begin.

3) Long-Term Hardening

• Require vendor accountability: Submit a request to Mercury's support team demanding a fix timeline and a CVE advisory. Reference CVE-2026-35901 explicitly.
• Network architecture overhaul: Place all IoT cameras on a dedicated IoT VLAN with no egress to the internet except via a managed streaming gateway. Disable any default "cloud P2P" features that may expose the device externally.
• Procurement policy: For new deployments, prioritize vendors with a demonstrable security responsiveness record and an established CVE advisory process (e.g., Axis, Hanwha, or established ONVIF-compliant vendors). Avoid low-cost "white-label" vendors like Mercury for security-critical installations.
• Regular firmware audit: Build a process to check vendor sites quarterly for updates, and script a manual test of this specific RTSP flaw after each firmware upgrade to catch regressions.
• Log retention: Enable syslog forwarding from the camera (if supported) to retain RTSP access logs for at least 90 days to support post-incident forensics.

References

1. NVD Entry: CVE-2026-35901 — https://nvd.nist.gov/vuln/detail/CVE-2026-35901 (Official NVD record, CVSS 4.4, CWE-400, last modified 2026-06-01)
2. MITRE CWE-400: Uncontrolled Resource Consumption — https://cwe.mitre.org/data/definitions/400.html (Underlying weakness classification)
3. FIRST CVSS Calculator: https://www.first.org/cvss/calculator/3.1 (For vector reconstruction and subscore analysis; the official vector string is UNKNOWN per NVD)
4. FIRST EPSS (Exploit Prediction Scoring System): https://www.first.org/epss/ (Score 0.00247, 16.1% percentile — indicates low near-term exploitation likelihood)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-35901 is NOT listed — no confirmed in-the-wild exploitation as of 2026-06-02)

Threat Actor Campaign Evidence: There are no publicly documented threat actor campaigns exploiting CVE-2026-35901 at the time of writing. The EPSS percentile and lack of CISA KEV inclusion suggest that the vulnerability has not yet attracted weaponization interest. However, the device class (cheap IP cameras with weak default credentials) is a perennial favorite of IoT botnet operators, and this flaw should be monitored for incorporation into future Mirai-style scanning clusters.