A critical flaw reported in Puwell IP Camera firmware 2.x through 4.x would let unauthenticated remote attackers run arbitrary OS commands as root by sending a crafted JSON payload to a debug service on TCP port 34567.
What Is It
CVE-2026-61515 is described as an unauthenticated command injection vulnerability in Puwell Technology Inc. IP Camera firmware. According to the advisory, the device exposes a "DebugShell" interface over a binary protocol service on TCP port 34567. That service is reported to neither authenticate callers nor sanitize input, so a crafted JSON payload can pass arbitrary commands straight to the underlying operating system.
The stated result is root-level code execution and complete device compromise. The issue is classified as CWE-912 (Hidden Functionality). It was disclosed via VulnCheck and published to NVD on 2026-08-04. The record is currently in "Received" status, meaning NVD has not yet completed its own analysis; the technical details and classification below come from the reporting CNA, not from independent NVD verification.
Why It Matters
The scoring supplied with the record reflects a worst-case profile: CVSS 3.1 base score 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 secondary score of 9.3 (Critical). Network reachable, low attack complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability alike. These figures are CNA-provided and may change if NVD analysis revises them.
If the described behavior holds, there is no authentication step to bypass and no user to phish. Anything that can reach port 34567 could own the camera outright.
What's Vulnerable
- Vendor: Puwell Technology Inc.
- Product: IP Camera
- Affected firmware: versions 2.x through 4.x (default status: affected)
- Attack surface: DebugShell interface on TCP port 34567
No affected CPE entries are listed in the NVD record at this time, so the version ranges above have not been mapped to specific product identifiers.
Patch Status
CVE-2026-61515 does not appear in the CISA Known Exploited Vulnerabilities catalog as of 2026-08-04 (see the KEV catalog link below). There is therefore no federal confirmation of active exploitation, no KEV-mandated remediation deadline, and no required action to report. Absence from KEV is not evidence that exploitation is not occurring.
The NVD record lists no patch, fixed version, or vendor mitigation guidance, and the only vendor-side reference in the record is Puwell's product catalog page. Because exposure requires network reach to TCP port 34567, restricting access to that port, via segmentation, firewall rules, or removing the device from internet-facing networks, is the only mitigation the available references support.
Sources
- NVD, CVE-2026-61515: https://nvd.nist.gov/vuln/detail/CVE-2026-61515
- VulnCheck Advisory; Puwell IP Camera 2.x–4.x Unauthenticated Command Injection via DebugShell: https://www.vulncheck.com/advisories/puwell-ip-camera-2-x-4-x-unauthenticated-command-injection-via-debugshell
- Damiri CVE Reference: https://damiri.fr/fr/cve/CVE-2026-61515
- Puwell Product Catalog: https://www.puwell.com/Index/catalog
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog