EUVD-2026-52689
GHSA-mm4w-x64v-48cj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated, low-complexity network exploitation of an exposed debug port yields root, so PR:N/UI:N/AC:L with full C/I/A impact; scope unchanged as compromise stays on the device.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise.
AnalysisAI
Unauthenticated remote code execution in Puwell IP Camera firmware versions 2.x through 4.x lets remote attackers achieve root-level control by sending a crafted JSON payload to an undocumented DebugShell service listening on TCP port 34567. Because the service performs neither authentication nor input sanitization, any attacker with network reach to the port can pass operating-system commands directly to the device, resulting in full compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the DebugShell service on TCP port 34567, which is exposed by default on affected firmware; the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no user interaction, and low complexity. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All independent signals point to genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans the internet for devices with TCP port 34567 open, identifies a Puwell-based camera, and sends a single crafted JSON request to the DebugShell service embedding shell metacharacters and OS commands. With no authentication or input filtering, the commands execute as root, giving the attacker a foothold to exfiltrate video, pivot into the internal network, or enroll the device into a botnet - and a public POC makes this repeatable at scale. |
| Remediation | No vendor-released patched firmware version is identified in the available data (no fix version supplied), so treat this as unpatched pending confirmation from Puwell - monitor https://www.puwell.com/Index/catalog and the VulnCheck advisory (https://www.vulncheck.com/advisories/puwell-ip-camera-2-x-4-x-unauthenticated-command-injection-via-debugshell) for firmware updates and apply the fixed release once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Puwell IP cameras in production environments, document firmware versions, and segregate affected devices to restricted network segments if operationally possible to limit attacker reach. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-912 – Hidden Functionality
View allShare
External POC / Exploit Code
Leaving vuln.today