EUVD-2026-52690
GHSA-h65q-x56f-vc5f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access to port 23456 with no interaction gives AV:N/AC:L/PR:N/UI:N; full video/control disclosure, motor/audio manipulation, and remote reboot yield C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can exploit the unvalidated Session field in the proprietary control protocol header to access live video streams, control pan and tilt motors, activate audio functions, and remotely restart the device.
AnalysisAI
Unauthenticated device takeover of Puwell IP Cameras (firmware 2.x through 4.x) is possible by sending protocol-conforming packets to TCP port 23456 and abusing the unvalidated Session field in the vendor's proprietary control protocol. Remote attackers with no credentials can view live video, drive pan/tilt motors, activate audio, and reboot the camera. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The device must be running Puwell IP Camera firmware 2.x-4.x and have its proprietary control service on TCP port 23456 reachable by the attacker; exploitation requires sending a protocol-conforming packet with any value in the unvalidated Session field, with no credentials, no user interaction, and no non-default configuration needed (consistent with AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent and point to genuine high priority for exposed devices. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans for internet-exposed devices listening on TCP port 23456, then sends a protocol-conforming control packet with an arbitrary Session value; because the field is never validated, the camera treats the request as authorized. The attacker streams live video and audio for surveillance, aims the camera away from an area using the PTZ motors, and issues a remote restart to cause an outage - all without credentials, aided by publicly available exploit code and the low attack complexity (AC:L) of the network-reachable protocol. |
| Remediation | No vendor-released patched firmware version is identified in the available data, so a specific upgrade target cannot be cited; monitor the vendor site (https://www.puwell.com/) and the VulnCheck advisory (https://www.vulncheck.com/advisories/puwell-ip-camera-2-x-4-x-unauthenticated-access-via-tcp-port-23456) for a fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Puwell IP Cameras across the organization and immediately block all inbound access to TCP port 23456 from untrusted networks via firewall rules; document each camera's location, firmware version, and network assignment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today