The MERCURY MIPC252W IP camera firmware 1.0.5 (Build 230306 Rel.79931n) fails to enforce nonce expiration for RTSP Digest authentication. This flaw (CWE‑294) allows an adjacent network attacker to capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials, gaining unauthorized access to the live video stream.

The only documented affected device is the MERCURY MIPC252W IP camera running firmware 1.0.5 (Build 230306 Rel.79931n). No other vendors, products, or versions are listed as impacted.

The vulnerability’s CVSS score of 9.1 signals critical severity, while the EPSS score of < 1 % indicates a low current exploitation likelihood. It is not cataloged in CISA’s KEV list. Exploitation requires only proximity to the camera’s local network; an attacker can capture the authentication challenge/response pair and replay it on a subsequent RTSP session, achieving persistent unauthorized viewing without any credential knowledge.