Puwell IP Camera CVE-2026-61515

Exploitation requires only network reachability to the DebugShell service on TCP port 34567, which is exposed by default on affected firmware; the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no user interaction, and low complexity. The concrete prerequisite is that port 34567 (the binary-protocol DebugShell interface) is reachable from the attacker - directly internet-exposed cameras or attackers already on the same LAN/VLAN qualify. The primary limiting factor is network segmentation: if the port is firewalled, NAT-isolated without port-forwarding, or confined to a management VLAN, remote exploitation is blocked. The affected population is limited to Puwell IP Camera firmware 2.x through 4.x (and OEM rebrands sharing that firmware).

All independent signals point to genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with total confidentiality, integrity, and availability impact - consistent with the description. Publicly available exploit code exists (VulnCheck advisory plus a third-party writeup), lowering the barrier to opportunistic and automated attacks against internet-exposed cameras, which are routinely mass-scanned. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here, and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation - the risk is driven by ease of exploitation and POC availability rather than confirmed campaigns. SSVC/KEV automatable and exploitation-status fields were not supplied; however, the trivial, unauthenticated, network vector strongly implies the attack is automatable. Overall this is a real, actionable priority for any exposed device, not a high-CVSS-but-low-real-risk case.

An attacker scans the internet for devices with TCP port 34567 open, identifies a Puwell-based camera, and sends a single crafted JSON request to the DebugShell service embedding shell metacharacters and OS commands. With no authentication or input filtering, the commands execute as root, giving the attacker a foothold to exfiltrate video, pivot into the internal network, or enroll the device into a botnet - and a public POC makes this repeatable at scale.