CVE-2026-61515

criticalCVSS 9.8covered by 1 sourcefirst seen 2026-08-04

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise.

⚡ Watch CVE-2026-61515

Get an email if CVE-2026-61515 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

criticalCVE-2026-61515: Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injecti…nvd · 2026-08-04

External references

NVD record for CVE-2026-61515

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-61515 status](https://www.csirts.com/badge/CVE-2026-61515)](https://www.csirts.com/cve/CVE-2026-61515)