Critical Command Injection Hits Puwell Cameras

Puwell IP cameras running firmware versions 2.x through 4.x contain a critical unauthenticated command injection vulnerability, identified as CVE-2026-61515. By sending a crafted JSON payload to the DebugShell interface on TCP port 34567, a remote attacker can execute arbitrary operating system commands with root-level privileges, leading to complete device compromise.

What's at Risk

The vulnerability affects Puwell IP cameras across firmware versions 2.x through 4.x. Organizations utilizing these cameras in internet-facing configurations are at the highest risk, as the flaw does not require authentication to exploit. Any entity relying on these devices for security or surveillance could see their infrastructure fully controlled by an unauthorized party.

How the Flaw Works

Command injection is a class of vulnerability that occurs when an application fails to properly sanitize user-supplied input before passing it to a system shell. In a general sense, this allows an attacker to append their own commands to the intended operations of the software. When a service like DebugShell lacks authentication and validation, it effectively serves as an open gateway. Once an attacker gains the ability to execute commands at the OS level, they can typically install persistent backdoors, pivot deeper into the local network, or use the device as a node in a larger botnet.

How to Protect Your Systems

• Check the Puwell website immediately for firmware updates that address CVE-2026-61515 and apply them to all affected units.
• Restrict access to TCP port 34567 using a firewall to ensure the DebugShell interface is not reachable from the public internet.
• Segment your camera network from critical business systems to minimize the potential impact if a device is compromised.
• Monitor network logs for unusual traffic patterns originating from or directed toward your IP camera infrastructure.
• Disable unnecessary services and features on all IoT devices to reduce the overall attack surface.

With a CVSS score of 9.8, this vulnerability represents a severe risk that requires immediate attention. Because the flaw allows for unauthenticated root-level access, the potential for total system takeover is high. Administrators should prioritize patching or network isolation to prevent unauthorized exploitation of these devices.