External risk intelligence

Puwell IP Camera Unauthenticated Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-61515

The vulnerability resides in an IP camera's DebugShell interface on a specific TCP port. IP cameras are frequently deployed with ports exposed to the public internet for remote monitoring, and this interface lacks authentication, making it directly reachable and exploitable from the internet by design.

Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Puwell IP camera firmware has a critical vulnerability allowing remote attackers to execute commands and take full control of devices without any authentication. This issue stems from an unauthenticated command injection flaw within the DebugShell interface.

Unauthenticated remote command execution in IP cameras.
Device compromise risk due to an exposed interface.
Confirm if affected cameras are internet-facing.

Attack Path

How an attacker could exploit the issue

Attackers can remotely exploit this vulnerability by sending a crafted JSON payload to an unauthenticated DebugShell interface on TCP port 34567. This allows them to execute arbitrary operating system commands, leading to root-level code execution and complete device compromise.

No authentication required.
Send crafted JSON payload.
Achieve full device compromise.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated command injection vulnerability in Puwell IP Camera firmware could allow remote attackers to execute arbitrary operating system commands. This is possible by sending a crafted JSON payload to the DebugShell interface, which is exposed on TCP port 34567. When supported by the advisory, this could lead to the compromise of the device.

Device firmware and commands.
Sending crafted JSON to DebugShell.
Complete device compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Puwell IP Camera firmware, likely managed by infrastructure or platform teams responsible for network-connected devices. The initial step is to locate all instances of the affected firmware, determine their network exposure and criticality, and identify the asset owners. Once identified, a remediation plan should be developed based on the assessed risk.

Infrastructure/Platform teams own remediation.
Verify external reachability and business impact.
Plan coordinated firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Puwell IP Camera software affected by CVE-2026-61515?

Puwell IP cameras are network-connected video surveillance devices used for remote monitoring and security. These cameras rely on internal firmware to manage hardware functions and network communication. This specific vulnerability involves a system component called DebugShell, typically intended for diagnostic tasks, which is integrated into the device's operational firmware.

How does this command injection vulnerability work?

The flaw is a weakness in how the system processes data, categorized as CWE-912. It occurs because the DebugShell interface lacks proper input validation. By sending a specifically formatted JSON payload to the service, an attacker can trick the system into running unauthorized operating system commands instead of just handling the intended data, effectively overriding the device's programmed behavior.

Do I need to authenticate to trigger this flaw?

No. The vulnerability exists because the DebugShell service on TCP port 34567 does not require any login credentials or user verification. Merely sending the malicious JSON payload to that port is sufficient to initiate the command execution. Normal, legitimate traffic that does not contain malicious command strings will not trigger the vulnerability.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, the risk is elevated because the affected DebugShell interface is often exposed directly to the public internet on many Puwell IP cameras to facilitate remote access. If your camera is reachable from the internet, it is a primary target. Devices restricted to internal, private networks are significantly less accessible to external attackers.

What should I do if I use Puwell IP cameras?

Begin by identifying all Puwell cameras in your environment and checking their firmware version. Prioritize checking those that are internet-facing, as these represent the most immediate risk. Work with your infrastructure or network team to restrict access to TCP port 34567 and prepare for firmware updates to address the underlying vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.