The vulnerability arises from a session handling flaw in the RTSP service of the Mercury MIPC252W camera. An attacker who has authenticated to the device can send a series of SETUP requests targeting the same media track within a single RTSP session. The server misprocesses this pattern, resetting the RTSP connection. This results in a denial‑of‑service condition that can interrupt live video streams or voice services. The weakness is categorized as uncontrolled resource consumption (CWE‑400).

The flaw is present only in the Mercury MIPC252W camera model 1.0.5 Build 230306 Rel.79931n. No other product or version information is available from the CNA.

The CVSS score of 4.4 indicates a low‑moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation. The attack requires valid authentication to the RTSP service and the ability to send repeated SETUP requests; once the pattern is detected, the server will restart the session, creating a DoS. Because no patch is currently available, the risk remains present until a firmware update is released.