Ip Camera
Monthly
Unauthenticated device takeover of Puwell IP Cameras (firmware 2.x through 4.x) is possible by sending protocol-conforming packets to TCP port 23456 and abusing the unvalidated Session field in the vendor's proprietary control protocol. Remote attackers with no credentials can view live video, drive pan/tilt motors, activate audio, and reboot the camera. Publicly available exploit code exists (disclosed by VulnCheck), and the CVSS 4.0 base score of 9.3 reflects network-reachable, no-interaction access with high confidentiality, integrity, and availability impact; there is no CISA KEV listing indicating active exploitation at this time.
Unauthenticated remote code execution in Puwell IP Camera firmware versions 2.x through 4.x lets remote attackers achieve root-level control by sending a crafted JSON payload to an undocumented DebugShell service listening on TCP port 34567. Because the service performs neither authentication nor input sanitization, any attacker with network reach to the port can pass operating-system commands directly to the device, resulting in full compromise. Reported by VulnCheck with publicly available exploit code exists; no public evidence of active in-the-wild exploitation (not in CISA KEV).
Unauthenticated device takeover of Puwell IP Cameras (firmware 2.x through 4.x) is possible by sending protocol-conforming packets to TCP port 23456 and abusing the unvalidated Session field in the vendor's proprietary control protocol. Remote attackers with no credentials can view live video, drive pan/tilt motors, activate audio, and reboot the camera. Publicly available exploit code exists (disclosed by VulnCheck), and the CVSS 4.0 base score of 9.3 reflects network-reachable, no-interaction access with high confidentiality, integrity, and availability impact; there is no CISA KEV listing indicating active exploitation at this time.
Unauthenticated remote code execution in Puwell IP Camera firmware versions 2.x through 4.x lets remote attackers achieve root-level control by sending a crafted JSON payload to an undocumented DebugShell service listening on TCP port 34567. Because the service performs neither authentication nor input sanitization, any attacker with network reach to the port can pass operating-system commands directly to the device, resulting in full compromise. Reported by VulnCheck with publicly available exploit code exists; no public evidence of active in-the-wild exploitation (not in CISA KEV).