CVE-2026-61515
CriticalCVSS 9.8Summary
Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise.
Risk Assessment
The risk includes complete takeover of the IP camera, which could lead to surveillance, disruption of device operation, or use as an entry point into the network.
Recommendation
It is recommended to immediately update the camera firmware to a version newer than 4.x if available, and to restrict access to port 34567 to trusted networks only.
Original NVD description (English source)
Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise.