CVE-2026-61515: Critical RCE in Puwell IP Cameras

CVE-2026-61515 is an unauthenticated command injection vulnerability in Puwell IP Camera firmware versions 2.x, 3.x, and 4.x. The flaw exists in the DebugShell service exposed on TCP port 34567, which accepts JSON payloads without verifying sender identity. A remote attacker can exploit insufficient input sanitization to inject arbitrary operating system commands directly, gaining root-level code execution and complete compromise of the camera device.

The official CVSS score is 9.8 (critical), reflecting the absence of authentication and the capability for remote root code execution. The vulnerability was published by the NVD on August 4, 2026. A significant signal emerged with the recent discovery (October 30, 2026) of public GitHub repositories declaring they contain exploits for this vulnerability, indicating the research community has developed verifiable proof-of-concept code.

System administrators and security leaders must treat this vulnerability with maximum urgency. Priority actions: inventory all Puwell cameras in use and verify installed firmware versions; immediately isolate unpatched devices from production networks or confine traffic to dedicated VLAN segments; actively monitor for unauthorized connection attempts on port 34567; check corrected firmware versions with the vendor and apply updates as soon as available; review access logs to identify potential prior exploitation attempts.