The vulnerability identified as CVE-2026-61514 affects Puwell IP Camera firmware versions from 2.0.0 up to but not including 3.0.0. It is caused by missing authentication on critical functions accessible via a proprietary control protocol over TCP port 23456. Attackers can bypass authentication by exploiting an unvalidated Session field in the protocol header, enabling them to perform unauthorized actions such as viewing live video, controlling camera movement, activating audio, and restarting the device remotely. The vulnerability is rated critical with a CVSS 4.0 base score of 9.3, indicating high impact and ease of exploitation without privileges or user interaction. There is no vendor advisory or patch currently available to address this issue.

Successful exploitation allows unauthenticated attackers to fully control affected IP cameras, including accessing live video feeds, manipulating camera orientation, activating audio functions, and remotely restarting the device. This compromises confidentiality, integrity, and availability of the device and its data streams, posing significant privacy and operational risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to TCP port 23456 on affected devices to trusted networks only. Consider isolating affected cameras from untrusted networks and monitoring for unusual traffic on the control port.