An insufficient input validation flaw in the RTSP service of the MERCURY MIPC252W camera allows an unauthenticated attacker to send an RTSP request that includes a Content-Length header but no body. The RTSP parser fails to reject the malformed request and instead enters a body‑waiting state, causing all subsequent data sent over the same TCP connection to be consumed as body content. The connection thus becomes unusable until a server‑side timeout terminates the session, resulting in a temporary denial of service for the camera.

The vulnerability affects MERCURY MIPC252W camera firmware v1.0.5 Build 230306 Rel.79931n, as referenced in the advisory linked at https://github.com/kkkk2222874/cve_ID_report/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_7th/README.md.

The CVSS score of 9.8 indicates a high severity for denial of service, and an EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely over the standard RTSP port and does not require authentication or prior compromise of the device.