CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed
Do Son 
TL;DR
Two critical Puwell IP Camera vulnerabilities now have public details and proof-of-concept exploit code. Both score 9.3 on the CVSS scale. Together they let a remote attacker bypass login and run commands as root. No vendor patch has been confirmed yet.
- Product: Puwell Technology Inc. IP Camera
- Vulnerabilities: 2 flaws (CVE-2026-61514, CVE-2026-61515)
- Highest severity: 9.8 (Critical · CVSSv3)
- Worst impact: Puwell 2.x - 4.x Unauthenticated Access via TCP Port 23456
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-61514 | 9.8 | Puwell 2.x - 4.x Unauthenticated Access via TCP Port 23456 | — | Not exploited |
| CVE-2026-61515 | 9.8 | Puwell 2.x - 4.x Unauthenticated Command Injection via DebugShell | — | Not exploited |
Why it matters
IP cameras sit on home and business networks worldwide. A full takeover exposes live video and a foothold inside the network. Because working exploit code is now public, the risk of attack rises sharply.
How the attacks work
The two Puwell IP Camera vulnerabilities target the camera’s proprietary control protocols. Each attack is unauthenticated and remote.
CVE-2026-61514: authentication bypass
The first flaw abuses an unvalidated Session field on TCP port 23456. As documented in the CVE-2026-61514 write-up, an attacker sends protocol-conforming packets without credentials. That grants access to video streams, pan-tilt motors, and audio.
CVE-2026-61515: command injection
The second flaw is an unauthenticated command injection on TCP port 34567. According to the CVE-2026-61515 disclosure, a crafted JSON payload hits an exposed DebugShell interface. The service lacks input sanitization, so commands pass straight to the operating system. This yields root-level code execution and full device compromise.
Exploitation status
Public proof-of-concept exploit code exists for both flaws. However, no in-the-wild exploitation has been confirmed at this time.
Affected versions
The flaws affect Puwell IP Camera firmware versions 2.x through 4.x.
Mitigation steps
No confirmed vendor fix is available yet. Until one ships, block TCP ports 23456 and 34567 from untrusted networks. Place cameras on an isolated VLAN. Also avoid exposing these devices directly to the internet.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
