CVE-2026-61515: Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell
Puwell Technology Inc. · IP Camera
No fix listed · Affected: Puwell Technology Inc. IP Camera · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub30 Oct
- Not established: not seen
Higher than 84% of scored CVEs
DescriptionNVD
Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise.
What changed
- PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 12 Aug.
- CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly DisclosedSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.