A flaw in the MERCURY MIPC252W camera firmware causes the RTSP service to ignore the Digest authentication response once a session has been established. After the initial DESCRIBE request is successfully authenticated, the camera does not verify the Digest response in subsequent SETUP, PLAY, or TEARDOWN requests. Consequently, an attacker with network access can replay the same nonce and session identifier and issue RTSP control commands even with an empty or invalid Authorization header. This allows unauthorized participants to interfere with camera streaming or potentially cause denial‑of‑service by repeatedly sending unsupported or repeated commands.

The vulnerability affects the MERCURY MIPC252W IP camera running firmware 1.0.5 Build 230306 Rel.79931n. No other vendors or products are documented as impacted.

The issue is scored with a CVSS score of 9.8 and an EPSS score of < 1%, but its availability of a public LAN‑based replay attack, combined with a potential for media disruption or service denial, makes the risk significant. The CVE is not listed in the CISA KEV catalog. An attacker can rely on the guaranteed reuse of valid nonce and session values; no privileged credentials or exploitation of a complex chain is required, so the feasibility of exploitation is moderate to high for devices exposed to a local network.