CVE-2026-51597
Last modified
CVE-2026-51597 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials, gaining unauthorized access to the live video stream.. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials, gaining unauthorized access to the live video stream.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | n/a |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-51597?
How severe is CVE-2026-51597?
How do I fix CVE-2026-51597?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-51565Cross-site scripting (XSS) vulnerability in Modules/Docs/Doc…6.1
- CVE-2026-5157A vulnerability was identified in code-projects Online Food …4.3
- CVE-2026-5158The Post Grid Gutenberg Blocks for News, Magazines, Blog Web…6.4
- CVE-2026-51583An issue in usememos through v0.30.0 allows a remote authent…
- CVE-2026-51584An issue in usememos v0.27.1 allows a remote attacker to ach…
- CVE-2026-5159The Royal Addons for Elementor plugin for WordPress is vulne…6.4
- CVE-2026-51598An input validation vulnerability in the RTSP service of MER…6.5
- CVE-2026-51599An insufficient input validation vulnerability in the RTSP s…9.8
- CVE-2026-5160Versions of the package github.com/yuin/goldmark/renderer/ht…6.1
- CVE-2026-51600Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Con…7.5
- CVE-2026-51601Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based bu…7.5
- CVE-2026-51602A stack-based buffer overflow vulnerability in the RTSP serv…7.5
Are you affected by CVE-2026-51597?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST