Cpe:2.3:a:puwell:ip_camera:2.0:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apuwellip_camera2.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 00:04:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPuwell IP Camera: Unauthenticated remote code execution via DebugShell (CVE-2026-61515)https://feed.craftedsignal.io/briefs/2026-10-puwell-rce/Sat, 31 Oct 2026 00:04:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-puwell-rce/Puwell IP cameras (firmware 2.x - 4.x) contain an unauthenticated remote code execution vulnerability in a DebugShell interface on TCP port 34567, which is currently being targeted by botnets.Puwell IP cameras running firmware versions 2.x through 4.x expose an undocumented 'DebugShell' interface on TCP port 34567. This interface processes JSON-formatted commands without requiring authentication and executes them directly via the system shell with root-level privileges. A functional proof-of-concept exploit is publicly available. The vulnerability has been identified as a vector in real-world botnet campaigns targeting IoT infrastructure.

Impact

Successful exploitation allows for complete system compromise, including unauthorized command execution with root privileges, data exfiltration, and potential integration of the camera into an IoT botnet.

Recommendation

  • Immediately block inbound and outbound traffic on TCP port 34567 at the network perimeter (WAN firewall) for all Puwell IP cameras.
  • Isolate all affected IP cameras into a restricted VLAN with no direct internet access; limit access to the internal network to authorized NVR systems only.
  • Disable UPnP on all camera devices to prevent automated port exposure.
  • Review firmware release notes for Puwell IP cameras and upgrade to any version post-4.x that addresses this DebugShell exposure.
  • Audit logs for established connections to TCP 34567 and subsequent execution of unauthorized child processes originating from the camera service.
]]>criticaladvisoryiotrcevulnerabilityiot-botnet