CVE-2026-61514: Puwell IP Camera authentication bypass over TCP/23456
TL;DR - Critical auth bypass in Puwell IP Camera firmware 2.x through 4.x. - Unauthenticated access is possible over TCP port 23456. - No confirmed fixed version or in-the-wild exploitation data yet, so isolate and restrict access now.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-61514 |
| CVSS | 9.8 (Critical) |
| Attack vector | Network |
| Privileges required | None |
| Patch available | Unknown / not confirmed from retrieved sources |
CVE-2026-61514 affects Puwell IP Camera firmware versions 2.x through 4.x and is described by NVD as an authentication bypass vulnerability reachable over TCP port 23456. The available technical description says the issue stems from an unvalidated Session field in a proprietary control protocol header. In practice, that means an attacker may be able to send protocol-conforming traffic that the device accepts without requiring valid credentials.
This is operationally serious because the documented impacts go beyond read-only access. According to the NVD description, a successful attacker may be able to view live video streams, control pan/tilt functions, activate audio, and restart the device remotely. For defenders, that turns this into both a privacy and physical security problem, especially where cameras are internet-exposed or reachable from untrusted internal segments.
What Is This Vulnerability?
At a technical level, CVE-2026-61514 is an authentication bypass caused by improper validation of a session-related field in a proprietary control protocol used by the camera firmware. The NVD description specifically identifies the Session field in the protocol header as unvalidated. That implies the device may trust client-supplied state that should instead be cryptographically bound, server-generated, or at minimum checked against an authenticated session context.
When a device accepts protocol messages based on a weak or unchecked session identifier, the control plane can become reachable without normal login enforcement. In this case, the described outcome is that protocol-conforming packets sent to TCP/23456 can trigger authenticated functions even when the sender has not presented credentials. Because the vulnerable interface appears to be a proprietary management or streaming control channel rather than a standard web login alone, teams that only review HTTP exposure may miss it.
The practical consequence is broader than a traditional password bypass on a web panel. If an attacker can speak the expected device protocol directly, they may be able to interact with multiple privileged functions from the network layer. That includes surveillance data access and motor control, which are especially sensitive in office, warehouse, retail, and residential monitoring deployments.
Technical Notes
The exact packet structure is not published in the source material available here, so defenders should avoid assuming the flaw is limited to a web endpoint or simple URL path. The strongest source-backed assumption is this: traffic to TCP/23456 carrying valid-looking proprietary control messages may be sufficient to invoke privileged device behavior without authentication.
Known source-backed technical indicators:
- Service port: TCP/23456
- Vulnerable component: proprietary control protocol
- Root cause: unvalidated "Session" field in protocol header
- Potential impacts: live video access, pan/tilt control, audio activation, device restart
Who Is Affected?
The affected product identified in the NVD record is Puwell IP Camera firmware / Puwell IP Camera devices. The only source-backed affected range currently available is “firmware versions 2.x through 4.x.” No more granular build numbers, model list, or hardware SKU mapping were confirmed from the retrieved sources.
That version statement matters because it is broad. If your asset inventory contains Puwell cameras running any firmware in the 2.x, 3.x, or 4.x families, you should treat them as potentially vulnerable unless Puwell provides a model-specific advisory stating otherwise. If you do not have firmware inventory at that level, assume exposure for all managed Puwell cameras until you validate the running version from the device UI, management software, or firmware file metadata.
There is also an exposure distinction defenders should keep in mind: internet-exposed cameras are the highest-risk group, but flat internal networks are also a problem. An unauthenticated network flaw with no privilege requirement can be exploited by anyone who can route traffic to the device, including a compromised workstation, rogue IoT node, contractor system, or VPN user on the same network.
Technical Notes
If you need to identify candidate devices quickly, start with asset discovery and service enumeration focused on TCP/23456.
# Identify systems exposing the reported service port
nmap -Pn -p 23456 192.168.0.0/16
# Faster broad scan with grepable output
masscan 192.168.0.0/16 -p23456 --rate 5000
If your CMDB or inventory platform stores vendor strings, filter for Puwell and then validate firmware versions manually. Because no official fixed version was confirmed, there is no reliable cutoff above 4.x that can be asserted from the available evidence.
CVSS Score Breakdown
The reported CVSS v3.x base score is 9.8, which places this issue in the Critical range. The exact vector string was not provided in the returned NVD tool record used for this article, so defenders should not rely on an assumed official vector. Still, the published description strongly supports the practical interpretation of why the score is so high.
A 9.8 score usually aligns with a vulnerability that is network exploitable, requires no authentication, and has high impact across confidentiality, integrity, and availability. That pattern matches the described behavior here. Access to live video affects confidentiality. Pan/tilt control and audio activation affect integrity by allowing unauthorized manipulation of device functions. Remote restart affects availability by allowing service interruption or forced downtime.
What is not confirmed is the exact NVD-assigned breakdown for adjacent factors such as user interaction or scope. In the absence of the vector string, the safest practitioner takeaway is to treat this as a remotely reachable, no-auth device-control vulnerability with severe operational impact. That is enough to justify urgent containment and review even before a vendor fix is published.
Technical Notes
Use the source-backed facts rather than reconstructing an official vector that has not been published in the available record.
Confirmed:
- CVSS base score: 9.8
- Attack path: network over TCP/23456
- Privileges required: none, based on NVD description of unauthenticated access
Not confirmed:
- Full CVSS vector string
- Whether any scope change was assigned
- Official vendor severity statement
Exploitation Status
As of 2026-08-04, CISA KEV does not list CVE-2026-61514. That means there is no CISA confirmation of active in-the-wild exploitation at the time of this check. It does not prove the vulnerability is not being exploited; it only means defenders should not claim confirmed KEV-backed exploitation at this time.
Likewise, a public proof of concept is not confirmed from the retrieved sources. One supplemental advisory reference exists, but the available content in this research session was truncated before exploitation details could be extracted reliably. No public repository, exploit write-up, or packet generator can be cited confidently from the evidence provided here.
In practical terms, defenders should classify exploitation status as unknown, but plausible. The conditions that generally make embedded-device flaws attractive are present: network exposure, no authentication, and security-impacting device actions. Because this affects cameras, opportunistic scanning and abuse are realistic concerns even before formal exploit code is documented publicly.
Technical Notes
Use external telemetry and perimeter monitoring to answer the exploitation question locally, especially if any affected device is exposed to the internet.
Current exploitation assessment:
- KEV listed: No
- Public PoC: Not confirmed
- In-the-wild exploitation: Not confirmed
- Defender assumption: Treat internet-exposed devices as likely targets for scanning
How to Detect It
The first detection priority is straightforward: find devices listening on TCP/23456 and map them to Puwell camera assets and firmware versions. If those systems are reachable from the internet, from guest networks, or from broad internal VLANs, the exposure should be considered urgent. Detection should combine asset inventory, network scanning, firewall logs, and, where available, camera-side connection logs.
The second priority is identifying suspicious traffic patterns to the proprietary control port. Because the protocol format is not publicly documented in the source material available here, defenders should focus on behavioral indicators rather than payload signatures alone. Multiple inbound connections to TCP/23456 from unexpected hosts, especially followed by camera restarts, PTZ movement, or audio activation, should be treated as suspicious.
If the cameras expose operational logs, look for session-related events, state changes, or control actions that do not correlate with known management stations or authorized operators. If device logs are limited, correlate firewall flow logs with physical or operational symptoms, such as unexplained camera movement or sudden reboot cycles.
Technical Notes
Concrete network and SIEM detection ideas:
# Splunk example: identify inbound connections to TCP/23456
index=network sourcetype=firewall (dest_port=23456 OR dpt=23456)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action
| sort - count
// Microsoft Sentinel / KQL style example
CommonSecurityLog
| where DestinationPort == 23456
| summarize Attempts=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, DeviceAction
| order by Attempts desc
# Simple Suricata rule to flag traffic to the reported service port
alert tcp any any -> any 23456 (msg:"Potential Puwell camera control traffic"; sid:6151401; rev:1;)
Example log pattern to hunt for in firewall or IDS data:
src=<untrusted_ip> dst=<camera_ip> dpt=23456 proto=tcp action=allow
If you have EDR or NDR tagging for IoT behavior, also hunt for connections from non-management hosts to cameras on TCP/23456, and review any sessions immediately preceding device reboot or PTZ movement events.
Mitigation and Patching
The most important limitation in current public data is this: a fixed version number is not confirmed from the retrieved sources. The NVD-backed affected range is “2.x through 4.x,” but no official vendor bulletin or verified firmware release containing a fix could be cited here. Because of that, defenders should not guess at a safe target version. Instead, contact Puwell or your reseller for an official security advisory and patched firmware guidance.
Until a fixed version is confirmed, mitigation should focus on exposure reduction. Restrict TCP/23456 so only explicitly authorized management stations can reach it, or block the port entirely if it is not required for your deployment. Remove internet exposure, place cameras on isolated VLANs, enforce ACLs between user networks and camera networks, and route remote access through a managed jump host or VPN with strong authentication. If a camera cannot be isolated and performs a sensitive function, replacement or temporary removal from service may be justified.
If you operate cameras in environments where PTZ or audio abuse would create safety, privacy, or compliance issues, you should raise the response priority even in the absence of confirmed exploitation. For organizations subject to regulatory requirements, document the lack of confirmed patch data and the compensating controls you implemented.
Technical Notes
Restrict access to the reported vulnerable service port immediately.
# Linux firewall example: block inbound access to TCP/23456
iptables -A INPUT -p tcp --dport 23456 -j DROP
# nftables example
nft add rule inet filter input tcp dport 23456 drop
Allow only a dedicated management host if the port is operationally necessary:
# iptables example: permit one management IP, block others
iptables -A INPUT -p tcp -s 10.10.10.25 --dport 23456 -j ACCEPT
iptables -A INPUT -p tcp --dport 23456 -j DROP
Example network segmentation control on a firewall or ACL policy:
permit tcp host 10.10.10.25 <camera_subnet> eq 23456
deny tcp any <camera_subnet> eq 23456
For patching, no source-backed upgrade command can be provided because the specific fixed firmware version is unknown. If your camera fleet is managed through a vendor utility or web UI, verify updates only against an official Puwell advisory. In the absence of that advisory, defenders should assume all firmware in the quoted affected range, 2.x through 4.x, remains at risk.
References
The primary source for this vulnerability is the NVD record for CVE-2026-61514, which provides the core description: affected product, affected versions, exposed port, root cause summary, and impact statements. That record is currently the strongest source-backed basis for triage and containment.
The CISA Known Exploited Vulnerabilities Catalog was checked and, at the time of writing, does not include CVE-2026-61514. Additional vendor and advisory references exist, but they did not yield fully extractable patch or exploitation details in the available research session. That is why several fields in this article are explicitly marked as unknown rather than inferred.
- NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-61514
- CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Puwell vendor site: https://www.puwell.com/
- NVD reference, inaccessible during retrieval: https://damiri.fr/fr/cve/CVE-2026-61514
- Supplemental advisory reference: https://www.vulncheck.com/advisories/puwell-ip-camera-2-x-4-x-unauthenticated-access-via-tcp-port-23456
If you are responsible for Puwell camera deployments, the immediate next steps are clear even with incomplete vendor patch data: inventory devices, find anything exposing TCP/23456, isolate reachable systems, and request an official fixed firmware version from Puwell.
For more information on cloud entitlement management, check out our article on What is Cloud Entitlement Management?. If you’re concerned about vulnerabilities like CVE-2026-61514, consider using a VPN for added security, such as NordVPN or Surfshark.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.