CVE-2026-61514 describes an authentication bypass vulnerability in Puwell IP Camera firmware versions >=2.0.0 and <3.0.0. The issue arises because the device does not validate the Session field in its proprietary control protocol header over TCP port 23456, allowing unauthenticated attackers to send protocol-conforming packets that grant access to sensitive device functions. These include live video streaming, motor control for pan and tilt, audio activation, and remote rebooting of the device. The vulnerability has a critical severity rating with a CVSS 4.0 score of 9.3, indicating high impact and ease of exploitation without any required privileges or user interaction. No known exploits are reported in the wild, and no vendor remediation or patch is currently documented.

An attacker can bypass authentication controls and remotely access and control critical functions of affected Puwell IP Cameras. This includes unauthorized live video surveillance, manipulation of camera orientation, activation of audio capture, and forced device restarts. Such access compromises confidentiality, integrity, and availability of the device and its data streams.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to TCP port 23456 on affected devices to trusted networks only. Monitor for unusual activity targeting this port and consider isolating vulnerable devices from untrusted networks.