Puwell IP Camera: Unauthenticated remote code execution via DebugShell (CVE-2026-61515)

Puwell IP cameras running firmware versions 2.x through 4.x expose an undocumented 'DebugShell' interface on TCP port 34567. This interface processes JSON-formatted commands without requiring authentication and executes them directly via the system shell with root-level privileges. A functional proof-of-concept exploit is publicly available. The vulnerability has been identified as a vector in real-world botnet campaigns targeting IoT infrastructure.

Impact

Successful exploitation allows for complete system compromise, including unauthorized command execution with root privileges, data exfiltration, and potential integration of the camera into an IoT botnet.

Recommendation

• Immediately block inbound and outbound traffic on TCP port 34567 at the network perimeter (WAN firewall) for all Puwell IP cameras.
• Isolate all affected IP cameras into a restricted VLAN with no direct internet access; limit access to the internal network to authorized NVR systems only.
• Disable UPnP on all camera devices to prevent automated port exposure.
• Review firmware release notes for Puwell IP cameras and upgrade to any version post-4.x that addresses this DebugShell exposure.
• Audit logs for established connections to TCP 34567 and subsequent execution of unauthorized child processes originating from the camera service.