SecurityOnlineDo Son
CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed
Part of the CVE-2026-20349 story · since 11 Aug
Quiet for 2 weekslast report 29 Oct8 articles4 outlets
- Tue 11 Aug, 22:35 UTC. CISA, first report. Cisco ASA/FTD heap bug lets remote attackers crash firewalls. Cites a CVE in CISA KEV.
- Wed 12 Aug, 00:17 UTC. CISA. CISA adds Cisco firewall heap flaw CVE-2026-20349 to KEV catalog. Cites a CVE in CISA KEV.
- Wed 12 Aug, 02:32 UTC. SecurityOnline, its first report on the story. Cisco ASA/FTD flaw lets attackers crash firewalls, CVE-2026-20349. Cites a CVE in CISA KEV.
- Wed 12 Aug, 05:20 UTC. SecurityWeek, its first report on the story. Cisco patches critical ASA/FTD zero day as attacks spike. Cites a CVE in CISA KEV.
- Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV. This article, 5th of 8.
- Thu 13 Aug, 17:21 UTC. Security Affairs, its first report on the story. CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall. Cites a CVE in CISA KEV.
- Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
- Thu 29 Oct, 10:30 UTC. SecurityWeek. Cisco fixes exploited VPN flaw that can crash firewalls. Cites a CVE in CISA KEV.
Three critical vulnerabilities were detected today: CVE-2026-20349 (Cisco Secure Firewall), CVE-2026-68820 (Microsoft Windows), and CVE-2026-72898 (Metabase). Additionally, two serious vulnerabilities in Puwell IP cameras, CVE-2026-61514 and CVE-2026-61515, have been disclosed, both scoring 9.8 on the CVSS scale. These allow remote attackers to bypass authentication and execute commands as root.
No vendor patches are available yet, but mitigation includes blocking specific TCP ports and isolating devices from untrusted networks. Public proof-of-concept exploit code is available for both vulnerabilities.
How the story developed
Quiet for 2 weekslast report 29 Oct8 articles4 outlets
8 articles from 4 outlets since 11 Aug. Quiet since 29 Oct. This was the 5th report, 15 hours after the first.
- Tue 11 Aug, 22:35 UTC. CISA, first report. Cisco ASA/FTD heap bug lets remote attackers crash firewalls. Cites a CVE in CISA KEV.
- Wed 12 Aug, 00:17 UTC. CISA. CISA adds Cisco firewall heap flaw CVE-2026-20349 to KEV catalog. Cites a CVE in CISA KEV.
- Wed 12 Aug, 02:32 UTC. SecurityOnline, its first report on the story. Cisco ASA/FTD flaw lets attackers crash firewalls, CVE-2026-20349. Cites a CVE in CISA KEV.
- Wed 12 Aug, 05:20 UTC. SecurityWeek, its first report on the story. Cisco patches critical ASA/FTD zero day as attacks spike. Cites a CVE in CISA KEV.
- Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV. This article, 5th of 8.
- Thu 13 Aug, 17:21 UTC. Security Affairs, its first report on the story. CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall. Cites a CVE in CISA KEV.
- Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
- Thu 29 Oct, 10:30 UTC. SecurityWeek. Cisco fixes exploited VPN flaw that can crash firewalls. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 8 articles as a listHide the list
- Tue 11 AugDay 01
- Cisco ASA/FTD heap bug lets remote attackers crash firewalls22:35 · CISA · official · First report · CISA alert · Known exploited CVE
- Wed 12 AugDay 14
- CISA adds Cisco firewall heap flaw CVE-2026-20349 to KEV catalog00:17 · CISA · official · Known exploited CVE
- Cisco ASA/FTD flaw lets attackers crash firewalls, CVE-2026-2034902:32 · SecurityOnline · Known exploited CVE
- CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed13:32 · SecurityOnline · Known exploited CVE · This article, 5th of 8
- Thu 13 AugDay 21
- CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall17:21 · Security Affairs · Known exploited CVE
Quiet for 3 days
Mon 17 AugDay 61- Critical Metabase SQLi flaw lets attackers seize full admin control02:40 · SecurityOnline · Picked up again · Known exploited CVE
Quiet for 10 weeks
Thu 29 OctDay 791- Cisco fixes exploited VPN flaw that can crash firewalls10:30 · SecurityWeek · Picked up again · Known exploited CVE