CVE-2026-61515

Name of the Vulnerable Software and Affected Versions Puwell IP Camera versions 2.x through 4.x

Description An unauthenticated command injection issue exists in the binary protocol service. Remote attackers can execute arbitrary operating system commands with root-level privileges by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. This is possible due to a lack of authentication and insufficient input sanitization, which can lead to complete device compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.