CVE-2026-61514: Puwell IP Camera Authentication Bypass

Executive Summary

A critical authentication bypass vulnerability in Puwell Technology Inc. IP Camera firmware versions 2.x through 4.x allows unauthenticated remote attackers to access device functions over the network without any credentials. Tracked as CVE-2026-61514 (CVSS 9.8), the flaw exists in the camera's TCP-based control protocol on port 23456, where an unvalidated Session field accepts any protocol-conforming packet as authorized.

No patch is currently available from the vendor. A proof-of-concept exploit has been published.

CVSS Score: 9.8 Critical

Vulnerability Overview

Root Cause

The Puwell IP Camera firmware exposes a network-accessible control protocol on TCP port 23456. The protocol includes a Session field that is designed to authenticate access to device functions — however, the firmware does not validate this field. An attacker can send any protocol-conforming packet with an arbitrary Session value and the device will execute the requested function as if the session were authenticated.

This is a classic CWE-306 (Missing Authentication for Critical Function) flaw: a security-sensitive interface that simply does not enforce the authentication it was designed to perform.

Affected Versions

Impact

A remote, unauthenticated attacker within network reach of an affected camera can:

• View live video streams from the camera in real time
• Control pan/tilt/zoom motors to reposition the camera
• Access audio functions including microphone and speaker
• Restart the device remotely, causing a denial-of-service
• Enumerate device state including configuration, network settings, and firmware version

In practice, this means any internet-exposed or network-reachable Puwell camera running affected firmware is fully accessible to any attacker who can reach it on port 23456 — with no password required.

Exploitation Details

Attack Chain

1. Attacker identifies Puwell IP camera reachable on TCP port 23456
   (internet scanning, local network access, or supply-chain knowledge)
2. Attacker constructs a protocol-conforming packet with any Session value
3. Camera processes the packet without validating the session
4. Attacker gains full control of camera functions
5. Live video feed, pan/tilt control, audio, and device restart all available

Proof-of-Concept

A public proof-of-concept exploit is available. Exploitation requires only basic network access to port 23456 and knowledge of the Puwell proprietary protocol format — both of which are derivable from the published PoC. Exploitation complexity is low.

Disclosure Timeline

Remediation and Mitigations

No vendor patch is currently available. Until Puwell releases a firmware update, apply the following mitigations:

Immediate Actions

1. Remove cameras from internet exposure — Do not expose port 23456 to the internet. Place all Puwell cameras behind a firewall that blocks inbound access to TCP 23456.
2. Segment cameras onto an isolated VLAN — IoT cameras should never share a network segment with corporate or sensitive systems. Network segmentation limits the blast radius if a camera is compromised.
3. Deploy network access controls — Use ACLs or firewall rules to restrict which IP addresses can reach camera management ports (23456 and other control ports).
4. Monitor for unauthorized access — Enable logging on network equipment for connections to port 23456. Alert on unexpected source IPs or access during off-hours.
5. Inventory all affected devices — Identify all Puwell cameras in your environment running firmware 2.x, 3.x, or 4.x and prioritize those with external network exposure.
6. Consider replacement — If operational requirements cannot tolerate the exposure, evaluate replacing affected cameras with units from vendors with active vulnerability disclosure and patching programs.

If a Patch Becomes Available

Monitor the NVD entry for CVE-2026-61514 and Puwell's official channel for patch announcements. Apply any available firmware update immediately upon release.

Detection

Network Indicators

Scanning Exposure

You can assess your organization's exposure by scanning for devices with port 23456 open:

# Internal network scan (authorized use only)
nmap -p 23456 --open 192.168.0.0/24

Why IoT Camera Vulnerabilities Matter

IP cameras are frequently overlooked in enterprise vulnerability management programs — they are treated as "just cameras" rather than as network-connected computers running complex firmware. In reality, compromised cameras can be used to:

• Conduct physical surveillance on operations, employees, or facilities
• Pivot to internal networks when cameras sit on shared VLANs
• Participate in botnets for DDoS attacks (as seen historically with Mirai-class botnets)
• Exfiltrate sensitive audio/video data from sensitive areas

Organizations with large camera deployments — warehouses, manufacturing floors, data centers, healthcare facilities — face particular risk if camera management interfaces are accessible without authentication.

Key Takeaways

1. CVSS 9.8 Critical — No authentication required, full device control over the network
2. All Puwell firmware 2.x–4.x is affected — No patch available as of August 5, 2026
3. PoC is public — Exploitation barrier is extremely low
4. Block port 23456 at the perimeter immediately if any affected cameras are internet-exposed
5. Segment IoT cameras onto isolated VLANs as a durable control

References

• NVD — CVE-2026-61514
• VulnCheck Advisory — CVE-2026-61514
• CWE-306 — Missing Authentication for Critical Function

Related Advisories

• CVE-2026-61515 — Puwell IP Camera Unauthenticated Command Injection