{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apuwellip_camera2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:puwell:ip_camera:2.0:*:*:*:*:*:*:*","cpe:2.3:a:puwell:ip_camera:4.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-61515"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["IP Camera (firmware 2.x–4.x)"],"_cs_severities":["critical"],"_cs_tags":["iot","rce","vulnerability","iot-botnet"],"_cs_type":"advisory","_cs_vendors":["Puwell"],"content_html":"\u003cp\u003ePuwell IP cameras running firmware versions 2.x through 4.x expose an undocumented 'DebugShell' interface on TCP port 34567. This interface processes JSON-formatted commands without requiring authentication and executes them directly via the system shell with root-level privileges. A functional proof-of-concept exploit is publicly available. The vulnerability has been identified as a vector in real-world botnet campaigns targeting IoT infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for complete system compromise, including unauthorized command execution with root privileges, data exfiltration, and potential integration of the camera into an IoT botnet.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately block inbound and outbound traffic on TCP port 34567 at the network perimeter (WAN firewall) for all Puwell IP cameras.\u003c/li\u003e\n\u003cli\u003eIsolate all affected IP cameras into a restricted VLAN with no direct internet access; limit access to the internal network to authorized NVR systems only.\u003c/li\u003e\n\u003cli\u003eDisable UPnP on all camera devices to prevent automated port exposure.\u003c/li\u003e\n\u003cli\u003eReview firmware release notes for Puwell IP cameras and upgrade to any version post-4.x that addresses this DebugShell exposure.\u003c/li\u003e\n\u003cli\u003eAudit logs for established connections to TCP 34567 and subsequent execution of unauthorized child processes originating from the camera service.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T00:04:15Z","date_published":"2026-10-31T00:04:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-puwell-rce/","summary":"Puwell IP cameras (firmware 2.x - 4.x) contain an unauthenticated remote code execution vulnerability in a DebugShell interface on TCP port 34567, which is currently being targeted by botnets.","title":"Puwell IP Camera: Unauthenticated remote code execution via DebugShell (CVE-2026-61515)","url":"https://feed.craftedsignal.io/briefs/2026-10-puwell-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:puwell:ip_camera:2.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}