Puwell IP Camera EUVD-2026-52690

The device must be running Puwell IP Camera firmware 2.x-4.x and have its proprietary control service on TCP port 23456 reachable by the attacker; exploitation requires sending a protocol-conforming packet with any value in the unvalidated Session field, with no credentials, no user interaction, and no non-default configuration needed (consistent with AV:N/AC:L/PR:N/UI:N). The primary limiting factor is network reachability of port 23456 - cameras isolated behind NAT/firewalls on trusted networks, or with that port filtered, are not remotely exploitable; there are no authentication, platform, or configuration prerequisites that otherwise constrain the attack.

Signals are largely consistent and point to genuine high priority for exposed devices. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes trivial, unauthenticated, no-interaction network exploitation against all three impact dimensions, and public exploit code raises practical exploitability further. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The vulnerability is not listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation despite the available POC - POC availability and active exploitation are distinct signals. The main real-world limiter is exposure: risk is critical for cameras whose port 23456 is reachable from the internet or an untrusted LAN segment, and materially lower for devices isolated behind NAT/firewalls on trusted networks. No SSVC decision data was supplied, so automatability and vendor-assigned exploitation status are unknown.

An attacker scans for internet-exposed devices listening on TCP port 23456, then sends a protocol-conforming control packet with an arbitrary Session value; because the field is never validated, the camera treats the request as authorized. The attacker streams live video and audio for surveillance, aims the camera away from an area using the PTZ motors, and issues a remote restart to cause an outage - all without credentials, aided by publicly available exploit code and the low attack complexity (AC:L) of the network-reachable protocol.