A null pointer dereference occurs in the RTSP service when processing a SETUP request for the path rtsp://<IP>:554/stream1/track2 with an improperly constructed Transport header. The malformed header causes the service to dereference a NULL pointer during request parsing, leading the device to crash and automatically reboot. Successful exploitation therefore results in a denial of service, as the camera becomes temporarily unavailable until it recovers from the reboot.

The vulnerability affects MERCURY MIPC252W cameras running firmware version 1.0.5 Build 230306 Rel.79931n. No other vendors or products are listed as impacted.

The vulnerability has a CVSS score of 7.5, indicating high severity, while its EPSS score remains very low (<1%), and it is not listed in the CISA KEV catalog. The exploit can be carried out remotely over the network by an attacker who can send crafted RTSP SETUP requests to the device’s port 554. Because the flaw only causes a crash and reboot, it does not permit code execution or data exfiltration. The primary risk is that a malicious actor can disrupt service by repeatedly triggering reboots.