CVE-2026-61514: critical vulnerability in Puwell Technology Inc. IP Camera
Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.3epss 0.8%
Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can exploit the unvalidated Session field in the proprietary control protocol header to access live video streams, control pan and tilt motors, activate audio functions, and remotely restart the device.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Puwell Technology Inc. · IP Camerapublic PoCs found — 1
cve_referencedamiri.fr/fr/cve/CVE-2026-61514unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Puwell Technology Inc. IP Camera
In the same product, most dangerous first.