CVE-2026-61515: Unauthenticated RCE in Puwell IP Camera via DebugShell

Vulnerability Overview CVE-2026-61515: Unauthenticated Remote Code Execution (RCE) Description: The vulnerability exists in the firmware of Puwell IP cameras, exposing an undocumented TCP service (port 34567) that transmits JSON messages using a binary protocol. This service allows unauthenticated users to execute system commands with root privileges. Attack Vector: Network access, no authentication required. Impact: Attackers can remotely execute arbitrary system commands, resulting in complete device compromise. Affected Scope Affected Devices: Puwell IP cameras (firmware v4.x). CVSS Score: 9.8 (High). Risks: Remote code execution, arbitrary command execution, complete device control, lateral movement within the network, firmware or configuration modification. Remediation Recommendation: Completely remove or disable the DebugShell interface in the firmware. If the debug interface is essential for development, it should only be included in development versions, and strict authentication and authorization mechanisms must be implemented. Debug interfaces should be disabled by default and must not be exposed to untrusted networks. Validation: All incoming protocol fields, including session identifiers, must be properly validated before processing privileged operations. Proof of Concept (PoC) Code Summary This vulnerability allows attackers to execute arbitrary system commands with root privileges on Puwell IP cameras through an unauthenticated TCP service (port 34567). It is recommended to completely remove or disable the DebugShell interface and implement strict authentication and authorization mechanisms in development versions. The provided PoC code demonstrates how to exploit this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-61515: Unauthenticated RCE in Puwell IP Camera via DebugShell