CVE-2026-35902 describes a denial of service vulnerability in the RTSP service of MERCURY IP camera MIPC252W version 1.0.5 Build 230306. The issue arises from improper handling of failed Digest authentication attempts. By sending repeated RTSP requests with invalid authentication parameters, an unauthenticated attacker can cause the RTSP service to enter a persistent failure state that blocks legitimate authentication attempts, effectively denying service to authorized users. The vulnerability is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts). No patch or remediation information is currently available, and there are no known exploits in the wild.

The vulnerability causes a denial of service condition by preventing legitimate clients from authenticating to the RTSP service of the affected IP camera. There is no impact on confidentiality or integrity. The attack requires local network access (AV:L) and no privileges or user interaction are needed. The medium CVSS score reflects the availability impact without broader system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, network-level controls such as limiting access to the RTSP service to trusted hosts may reduce exposure. Monitoring for unusual authentication failure patterns could help detect exploitation attempts. No official fix or temporary workaround is currently documented.