CVE-2026-61515: Puwell IP Camera Unauthenticated Command Injection

Executive Summary

A critical unauthenticated remote code execution vulnerability in Puwell Technology Inc. IP Camera firmware versions 2.x through 4.x allows any remote attacker to execute arbitrary operating system commands at root level with no authentication, no input sanitization, and no user interaction. Tracked as CVE-2026-61515 (CVSS 9.8), the vulnerability exploits a hidden DebugShell interface exposed on TCP port 34567 that accepts arbitrary JSON-encoded command input.

No vendor patch is available. A proof-of-concept exploit has been published. This vulnerability is a companion flaw to CVE-2026-61514 (authentication bypass), with both affecting the same firmware versions and published on the same day.

CVSS Score: 9.8 Critical

Vulnerability Overview

Root Cause

Puwell IP Camera firmware versions 2.x through 4.x contain a hidden DebugShell interface accessible on TCP port 34567. This interface — classified under CWE-912 (Hidden Functionality) — was likely introduced during development for debugging and diagnostics purposes but was never removed from production firmware.

The DebugShell accepts JSON-formatted payloads containing OS commands. It performs no authentication check, no input sanitization, and no allowlist enforcement. Any command passed in the cmd field of a JSON payload is executed directly by the device's operating system shell — as root.

Affected Versions

Impact

A remote, unauthenticated attacker within network reach of an affected camera can:

• Execute arbitrary OS commands as root — full device compromise
• Read, modify, or delete any file on the device filesystem
• Exfiltrate credentials, configuration, and cryptographic material stored on the device
• Install persistent backdoors or malware in device firmware
• Use the device as a pivot point to attack other hosts on the camera's network segment
• Brick the device permanently by overwriting critical system files

This is a full device takeover vulnerability. The combination of hidden functionality, no authentication, and root-level execution makes this among the most severe categories of IoT vulnerabilities.

Exploitation Details

Attack Chain

1. Attacker identifies Puwell IP camera reachable on TCP port 34567
2. Attacker sends a JSON payload: {"cmd": "<arbitrary OS command>"}
3. DebugShell receives the payload with no authentication check
4. Camera executes the command as root with no input filtering
5. Attacker receives command output; gains persistent root shell
6. Lateral movement, data exfiltration, or botnet enrollment follows

Proof-of-Concept Example

# No authentication required — replace <camera-ip> with target address
echo '{"cmd":"id"}' | nc <camera-ip> 34567
# Returns: uid=0(root) gid=0(root) groups=0(root)
 
echo '{"cmd":"cat /etc/passwd"}' | nc <camera-ip> 34567
# Returns full /etc/passwd with no access control

A more complete public PoC exploit is available from the disclosing researcher.

Relationship to CVE-2026-61514

CVE-2026-61515 and CVE-2026-61514 are companion vulnerabilities in the same Puwell IP Camera firmware:

CVE-2026-61515 is the more severe of the two. An attacker exploiting both in sequence achieves complete, persistent control over an affected device with no defenses between them and root.

Disclosure Timeline

Remediation and Mitigations

No vendor patch is currently available. The following mitigations should be applied immediately, particularly for any cameras with internet or untrusted network exposure.

Immediate Actions

1. Block TCP port 34567 at all network perimeters and firewall boundaries — This is the single most effective mitigation. No legitimate external access to the DebugShell interface should exist in any production environment.
2. Block TCP port 23456 as well — Companion vulnerability CVE-2026-61514 uses this port; block both simultaneously.
3. Segment cameras onto an isolated IoT VLAN — Prevent cameras from communicating with production servers, workstations, or sensitive infrastructure even if compromised.
4. Assume compromise for internet-exposed devices — If any affected camera was exposed to the internet on port 34567, treat it as potentially compromised and initiate incident response procedures.
5. Inventory and audit all Puwell cameras — Confirm firmware versions and identify all affected devices. Prioritize internet-connected units.
6. Evaluate device replacement — Given the severity of both CVEs and the absence of patches, consider replacing affected cameras with devices from vendors with active security programs.

Network Detection

Search your environment for devices listening on TCP 34567:

# Scan your network for exposed DebugShell ports (authorized use only)
nmap -p 34567 --open 192.168.0.0/24

Detection

Network Indicators

Checking for Active Exploitation

If you have visibility into network traffic to/from cameras, look for JSON-formatted payloads directed at port 34567. Any such traffic is an exploitation attempt — the DebugShell has no legitimate external use.

Broader IoT Security Context

The Puwell CVE-2026-61515 follows a well-documented pattern in IoT device security failures:

• Debug interfaces left in production firmware — A systemic problem across IP camera, router, and embedded device vendors
• No authentication on privileged interfaces — Development conveniences that become critical exposures at scale
• Root execution by default — IoT firmware frequently runs all processes as root, eliminating any privilege separation
• Long vulnerability lifecycles — Many IoT devices are never patched, leaving vulnerabilities active for years

Organizations should treat unpatched IoT devices as untrusted nodes regardless of their physical placement and design network architectures that contain the damage an individual device compromise can cause.

Key Takeaways

1. CVSS 9.8 Critical — Unauthenticated root command execution, no authentication, no complexity
2. Hidden DebugShell on TCP 34567 — Classic CWE-912 hidden functionality left in production firmware
3. Pairs with CVE-2026-61514 — Both affect the same firmware; combined exploitation means complete, persistent device control
4. No patch available — Block port 34567 immediately at all firewall boundaries
5. Treat internet-exposed devices as compromised — Initiate incident response if port 34567 was reachable externally

References

• NVD — CVE-2026-61515
• VulnCheck Advisory — CVE-2026-61515
• CWE-912 — Hidden Functionality

Related Advisories

• CVE-2026-61514 — Puwell IP Camera Authentication Bypass