Vulnerability · Published Aug 4, 2026 · Assigned by VulnCheck

CVE-2026-61514Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456

Critical 9.8

In plain English

A critical-severity missing authentication in IP Camera from Puwell Technology Inc.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 42.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can exploit the unvalidated Session field in the proprietary control protocol header to access live video streams, control pan and tilt motors, activate audio functions, and remotely restart the device.

Affected products (as reported)

Vendor	Product	Versions
Puwell Technology Inc.	IP Camera	2.x – through 4.x

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description, exploit
Vendor Homepage product
https://www.vulncheck.com/advisories/puwell-ip-camera-2-x-4-x-unauthenticated-access-via-tcp-port-23456 third-party-advisory