CVE-2026-35903 describes an authentication bypass vulnerability in the RTSP service of MERCURY MIPC252W IP camera firmware 1.0.5 Build 230306 Rel.79931n. The device performs Digest authentication correctly only on the initial DESCRIBE request but does not validate the Digest response parameter on subsequent RTSP requests within the same session. Consequently, an attacker who has successfully authenticated once can reuse the nonce and session identifier to issue unauthorized RTSP control commands without recomputing a valid Digest response, potentially controlling the camera's streaming session.

An attacker with network access to the affected IP camera can bypass proper Digest authentication checks after an initial successful authentication. This allows unauthorized control of RTSP methods such as SETUP, PLAY, and TEARDOWN, which could lead to unauthorized video stream manipulation or disruption. There is no indication that this vulnerability allows full device compromise or access beyond RTSP control commands.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the RTSP service to trusted users only and monitor for unusual RTSP session activity. No official remediation or temporary fix has been published at this time.