An insufficient input validation flaw (CWE-20) in the RTSP service of the MERCURY MIPC252W camera allows an unauthenticated attacker to send an RTSP request that includes a Content-Length header but no body. The RTSP parser fails to reject the malformed request and instead enters a body‑waiting state, causing all subsequent data sent over the same TCP connection to be consumed as body content. The connection thus becomes unusable until a server‑side timeout terminates the session, resulting in a temporary denial of service for the camera.

The vulnerability affects MERCURY MIPC252W camera firmware v1.0.5 Build 230306 Rel.79931n, as referenced in the advisory linked at https://github.com/kkkk2222874/cve_ID_report/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_7th/README.md.

The CVSS score of 9.8 indicates a high severity for denial of service, and an EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a remote unauthenticated attacker sending crafted RTSP requests to the camera, though the specific port was not explicitly stated.