CVE-2026-35903 describes an authentication bypass vulnerability in the RTSP service of MERCURY MIPC252W IP camera firmware 1.0.5 Build 230306 Rel.79931n. The device performs Digest authentication correctly only on the initial DESCRIBE request but does not validate the Digest response parameter in subsequent RTSP requests within the same session. Consequently, an attacker who has successfully authenticated once can reuse the nonce and session identifier to issue unauthorized RTSP control commands without computing a valid Digest response. This allows unauthorized control over RTSP methods such as SETUP, PLAY, and TEARDOWN, potentially leading to full compromise of the camera's streaming control.

Successful exploitation allows an unauthenticated attacker with network access to bypass authentication controls after an initial valid authentication. This enables unauthorized execution of RTSP commands that control the camera's streaming session, potentially leading to full compromise of confidentiality, integrity, and availability of the video stream and device operation. The CVSS score of 9.8 reflects critical impact across all security objectives.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the affected device's RTSP service to trusted users only and monitor for unusual RTSP session activity to reduce risk.