CVE-2026-61515

This CVE exposes an unauthenticated DebugShell service running on port 34567 across Puwell camera firmware versions 2.x through 4.x. The service accepts raw OS commands with root privileges—no authentication required, no credential needed. This is not a subtle logic flaw; it's a direct root shell delivered by the product. The vulnerability rates 9.8 because it grants the highest privilege level (root) with no user interaction required and trivially discoverable network access. The port number 34567 is high but predictable; anyone port-scanning a Puwell camera will find it immediately. What makes this值得注意 is not the bug but the pattern. This DebugShell persisted across three major firmware releases—meaning at no point in Puwell's release process did anyone flag 'remove this before shipping.' That's a structural failure in their firmware development lifecycle, not a one-time oversight. You should assume other Puwell devices in the same generation share similar debug infrastructure. Your immediate actions: First, firewall port 34567 at the network boundary—block all external traffic and restrict internal access to explicitly authorized management subnets. Second, verify whether your Puwell cameras are internet-facing; if they are behind NAT but still reachable via port forwarding, treat them as exposed. Third, check firmware version; if you're on 2.x-4.x and a newer release exists, apply it immediately and verify the DebugShell is actually removed in the new build. Fourth, assume compromise if this port was accessible externally—audit for signs of lateral movement, especially into the VMS/NVR infrastructure that manages these cameras, which typically trusts camera endpoints. The EPSS score suggests moderate probability of exploitation in the next 30 days. Given the trivial exploitability and exposed root shell, threat-intelligence-informed defenders should treat this as active-target priority. The worst-case escalation isn't command injection—it's using this as a beachhead to push malicious firmware via an unauthenticated update mechanism, achieving persistent hardware-level compromise.

Reviewed through automated stages and approved by a human before publication.