An authentication bypass vulnerability in Puwell IP Cameras allows unauthenticated attackers to remotely hijack device functions and access video streams.

This is a missing authentication for critical function flaw (CWE-306) in the proprietary control protocol. Unauthenticated attackers can manipulate the Session field in the packet header to gain unauthorized administrative control over hardware components, including pan and tilt motors and audio output.

Successful exploitation poses a severe risk to physical security and operational privacy. With a CVSS score of 9.8, the vulnerability allows for complete unauthorized control over surveillance hardware, which could lead to unauthorized monitoring of sensitive areas or the disabling of security systems.

Immediate Action: Contact the vendor for the latest firmware update that addresses this authentication flaw. If a firmware update is not yet available, restrict network access to the device to trusted internal management segments only.

Proactive Monitoring: Monitor network traffic directed to TCP port 23456 for anomalous packet structures or unauthorized connection attempts.

Compensating Controls: Deploy a network firewall to block inbound traffic on TCP port 23456 from untrusted sources.

Public Exploit Available: No (exploit_available unknown).

Given the critical severity and the existence of a proof-of-concept, organizations using affected Puwell IP Cameras must prioritize restricting access to these devices immediately. Apply vendor-provided patches as soon as they become available to remediate the underlying authentication failure.