Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command…

Puwell Technology IP Camera

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567.

Still cooking for IP Camera.

First seen: 30 Oct 2026
Last update: 30 Oct 2026, 23:17 UTC
Identifiers: CVE-2026-61515
CVSS: 9.8
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command…
Severity: critical. Patch status: fix status unknown.
Affected: Puwell Technology IP Camera
Ids: CVE-2026-61515

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567.

## Steps
1. Search the repo, its CI and infra config for Puwell Technology IP Camera. If present, report the version in use and whether it's affected.
2. IP Camera <= 4.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| IP Camera <= 4.x | not named in the CVE record | check the vendor advisory: https://damiri.fr/fr/cve/CVE-2026-61515 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-61515") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://damiri.fr/fr/cve/CVE-2026-61515 https://nvd.nist.gov/vuln/detail/CVE-2026-61515
https://pwned.coffee/i/puwell-ip-camera-firmware-versions-2-x-through-4-x-conta-cve-2026-61515

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-61515 "poc" (SSVC).” source
Fix by release line: Product Affected Fixed in Source
IP Camera <= 4.x fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 30 Oct
The CVE record names no fix for one line; the vendor’s advisory may: damiri.fr
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA VulnCheck) for CVE-2026-61515
Last checked: 30 Oct 2026, 23:18 UTC

Product	Affected	Fixed in	Source
IP Camera	<= 4.x	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 30 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee