CVE-2026-51599: n/a
An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding message body. The affected RTSP parser enters a body-waiting state instead of rejecting the malformed request, causing all subsequent data on the connection to be silently consumed as body content until a server-side timeout closes the connection.
AI Analysis
Technical Summary
CVE-2026-51599 describes an insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n. The RTSP parser incorrectly handles requests that include a Content-Length header without an accompanying message body, entering a state where it waits for the body indefinitely. This causes the affected TCP connection to be rendered temporarily unusable as subsequent data is consumed silently until a timeout occurs, effectively causing a denial of service on that connection. The vulnerability can be triggered by an unauthenticated remote attacker.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by making an individual TCP connection unusable temporarily. This disrupts legitimate RTSP communication on that connection until the server-side timeout closes it. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector, but the primary practical impact is denial of service on the affected connection.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, consider limiting exposure of the RTSP service to untrusted networks and monitor for abnormal connection behavior.
CVE-2026-51599: n/a
Description
An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding message body. The affected RTSP parser enters a body-waiting state instead of rejecting the malformed request, causing all subsequent data on the connection to be silently consumed as body content until a server-side timeout closes the connection.
CVSS v3.1
Score 9.8critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-51599 describes an insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n. The RTSP parser incorrectly handles requests that include a Content-Length header without an accompanying message body, entering a state where it waits for the body indefinitely. This causes the affected TCP connection to be rendered temporarily unusable as subsequent data is consumed silently until a timeout occurs, effectively causing a denial of service on that connection. The vulnerability can be triggered by an unauthenticated remote attacker.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by making an individual TCP connection unusable temporarily. This disrupts legitimate RTSP communication on that connection until the server-side timeout closes it. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector, but the primary practical impact is denial of service on the affected connection.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, consider limiting exposure of the RTSP service to untrusted networks and monitor for abnormal connection behavior.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-06-08T00:00:00.000Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4fd7da68715ace43c44413
Added to database: 07/09/2026, 17:18:18 UTC
Last enriched: 07/17/2026, 09:45:23 UTC
Last updated: 08/23/2026, 22:52:11 UTC
Views: 91
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.