CVE-2026-61514: Puwell IP Camera Auth Bypass Vulnerability

CVE-2026-61514 Overview

CVE-2026-61514 is an authentication bypass vulnerability affecting Puwell IP Camera firmware versions 2.x through 4.x. The flaw resides in the proprietary control protocol exposed on TCP port 23456. Attackers send protocol-conforming packets with an unvalidated Session field to invoke device functions without supplying credentials. Successful exploitation grants access to live video streams, pan and tilt motor control, audio activation, and remote device restart. The issue is categorized under CWE-306: Missing Authentication for Critical Function. Because the service is network reachable and requires no user interaction, exposed cameras can be fully compromised from any host that can reach TCP port 23456.

Critical Impact
Unauthenticated remote attackers can hijack video and audio feeds, manipulate camera positioning, and reboot Puwell IP cameras across the affected firmware range.

Affected Products

Puwell IP Camera firmware version 2.x
Puwell IP Camera firmware version 3.x
Puwell IP Camera firmware version 4.x

Discovery Timeline

2026-08-04 - CVE-2026-61514 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-61514

Vulnerability Analysis

Puwell IP Cameras expose a proprietary binary control protocol on TCP port 23456. The protocol header contains a Session field intended to bind requests to an authenticated session. The firmware never validates that the Session value corresponds to an established, authorized session. Any client that constructs a protocol-conforming packet can therefore invoke privileged commands. Available commands include live video stream retrieval, pan and tilt motor actuation, microphone and speaker activation, and remote reboot. The vulnerability affects the entire 2.x through 4.x firmware lineage, indicating the authentication check was never implemented in the control channel.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The camera treats the client-supplied Session identifier as trusted state rather than verifying it against a server-side session table populated only after credential validation. There is no fallback authentication layer on the port 23456 service.

Attack Vector

Exploitation is network based and requires no privileges or user interaction. An attacker with TCP reachability to the camera crafts a control packet with any Session value, sets the desired command opcode, and transmits it to port 23456. The camera responds by executing the requested operation and, for streaming commands, returns the requested media data. Internet-exposed cameras and cameras on flat local networks are equally reachable to adversaries positioned appropriately. Refer to the VulnCheck Advisory on Puwell IP Camera and the Damiri CVE-2026-61514 write-up for protocol specifics.

Detection Methods for CVE-2026-61514

Indicators of Compromise

Inbound TCP connections to port 23456 on IP camera hosts from unexpected internal or external sources.
Unscheduled camera reboots, pan/tilt movement, or audio activation not correlated with legitimate operator actions.
Outbound video or audio streams from cameras to destinations outside the video management system.

Detection Strategies

Deploy network monitoring rules that alert on any TCP session to port 23456 originating outside the authorized video management server subnet.
Baseline camera command traffic volume and flag deviations that indicate scripted command replay.
Correlate camera reboot events and motor-command frequency with authentication logs from the video management platform to identify unauthenticated actions.

Monitoring Recommendations

Ingest camera and network flow telemetry into a centralized analytics platform to retain long-term connection history to port 23456.
Enable alerting on new TCP listeners exposed on IoT VLANs, particularly on non-standard ports such as 23456.
Track firmware version inventory and flag any device still running Puwell firmware in the 2.x through 4.x range.

How to Mitigate CVE-2026-61514

Immediate Actions Required

Block inbound traffic to TCP port 23456 at the network perimeter and remove any port-forwarding rules exposing cameras to the internet.
Restrict access to the camera management VLAN so that only the video management server can reach port 23456.
Inventory all Puwell IP Camera devices and identify firmware versions in the affected 2.x through 4.x range.

Patch Information

No vendor patch is referenced in the advisory sources at the time of publication. Monitor the Puwell homepage and the VulnCheck advisory for firmware updates. Until a fixed firmware release is available, treat all affected devices as unauthenticated services and apply compensating network controls.

Workarounds

Place affected cameras on an isolated VLAN with strict access control lists permitting only the video management server.
Terminate any WAN exposure of TCP port 23456 and require VPN access for remote viewing.
Consider replacing internet-facing Puwell cameras with models that enforce authenticated control protocols if no firmware fix is released.

bash

# Example iptables rule to restrict access to camera control port 23456
# Allow only the video management server (10.0.10.5) to reach the cameras
iptables -A FORWARD -p tcp --dport 23456 -s 10.0.10.5 -d 10.0.20.0/24 -j ACCEPT
iptables -A FORWARD -p tcp --dport 23456 -d 10.0.20.0/24 -j DROP