CVE-2026-61515

The record

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise.

Affected packages

Related vulnerabilities

• CVE-2026-15413 The Link Factory WordPress plugin is a backdoor. CWE-912
• CVE-2026-18844 The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands… CWE-912
• CVE-2026-17032 Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's… CWE-912
• CVE-2026-14812 The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that… CWE-912
• CVE-2026-11976 The official MonsterInsights Pro update distribution bucket… CWE-912
• CVE-2026-4769 Certain devices in the WAGO System I/O Field series activate an internal diagnostic… CWE-912
• CVE-2026-41446 Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain… CWE-912
• CVE-2026-1952 Delta Electronics AS320T has denial of service via the undocumented subfunction… CWE-912