CVE-2026-51599: An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individ
An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding message body. The affected RTSP parser enters a body-waiting state instead of rejecting the malformed request, causing all subsequent data on the connection to be silently consumed as body content until a server-side timeout closes the connection.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-51599
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-515990.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-51599 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for An insufficient input
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-11898: The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admi…nvd · 2026-07-11
- highCVE-2026-15298: The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all vers…nvd · 2026-07-10
- mediumCVE-2026-31981: A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to …nvd · 2026-07-09
- highCVE-2026-15122: Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.…nvd · 2026-07-08
- lowCVE-2026-15115: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior…nvd · 2026-07-08
- unknownCVE-2026-13865: Chromium: CVE-2026-13865 Insufficient validation of untrusted input in Enterprisemsrc · 2026-07-02
More from NVD Recent CVEs
- unknownCVE-2026-57828: The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload t…2026-07-11
- unknownCVE-2026-57827: The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that al…2026-07-11
- highCVE-2026-1359: The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized m…2026-07-11
- highCVE-2026-9282: The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up…2026-07-11
- mediumCVE-2026-9017: The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to autho…2026-07-11