CVE-2026-61515

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://damiri.fr/fr/cve/CVE-2026-61515
https://www.puwell.com/Index/catalog
https://www.vulncheck.com/advisories/puwell-ip-camera-2-x-4-x-unauthenticated-command-injection-via-debugshell

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de firmware de la cámara IP Puwell 2.x a 4.x contiene una vulnerabilidad de inyección de comandos no autenticada que permite a atacantes remotos ejecutar comandos arbitrarios del sistema operativo enviando una carga útil JSON manipulada a la interfaz DebugShell expuesta en el puerto TCP 34567. Los atacantes pueden explotar la falta de autenticación y saneamiento de entrada en el servicio de protocolo binario para pasar comandos arbitrarios directamente al sistema operativo subyacente, logrando la ejecución de código a nivel de root y el compromiso completo del dispositivo.

Information

Published : 2026-08-04 15:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-61515

Mitre link : CVE-2026-61515

CVE.ORG link : CVE-2026-61515

JSON object : View

Products Affected

No product.

CWE

CWE-912

Hidden Functionality

{"id": "CVE-2026-61515", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61515", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-04T19:44:27.471848Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Puwell Technology Inc.", "product": "IP Camera", "versions": [{"status": "affected", "version": "2.x", "versionType": "custom", "lessThanOrEqual": "4.x"}], "defaultStatus": "affected"}]}], "published": "2026-08-04T15:16:36.967", "references": [{"url": "https://damiri.fr/fr/cve/CVE-2026-61515", "source": "disclosure@vulncheck.com"}, {"url": "https://www.puwell.com/Index/catalog", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/puwell-ip-camera-2-x-4-x-unauthenticated-command-injection-via-debugshell", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-912"}]}], "descriptions": [{"lang": "en", "value": "Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise."}, {"lang": "es", "value": "Las versiones de firmware de la c\u00e1mara IP Puwell 2.x a 4.x contiene una vulnerabilidad de inyecci\u00f3n de comandos no autenticada que permite a atacantes remotos ejecutar comandos arbitrarios del sistema operativo enviando una carga \u00fatil JSON manipulada a la interfaz DebugShell expuesta en el puerto TCP 34567. Los atacantes pueden explotar la falta de autenticaci\u00f3n y saneamiento de entrada en el servicio de protocolo binario para pasar comandos arbitrarios directamente al sistema operativo subyacente, logrando la ejecuci\u00f3n de c\u00f3digo a nivel de root y el compromiso completo del dispositivo."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}