CVE-2026-51599

An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding message body. The affected RTSP parser enters a body-waiting state instead of rejecting the malformed request, causing all subsequent data on the connection to be silently consumed as body content until a server-side timeout closes the connection.

9.8 CRITICALEPSS 0.53%Not in KEVNVD: Deferred

Last updated: 2026-10-25 17:10 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.8	CRITICAL	3.1CISA-ADP	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CVE ID: CVE-2026-51599
Status: Deferred
Assigner (CNA): mitre
Published: Jul 9, 2026
Last modified: 2026-10-25 17:10 UTC
Weaknesses: CWE-20

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:39 UTC.