An unauthenticated command injection vulnerability in Puwell IP Cameras allows remote attackers to achieve root-level code execution and complete device compromise.

This vulnerability involves a hidden DebugShell functionality (CWE-912) that fails to perform authentication or input sanitization on incoming JSON payloads. Unauthenticated remote attackers can inject and execute arbitrary operating system commands at the root level.

The ability to execute arbitrary commands at the root level provides an attacker with complete control over the device. With a CVSS score of 9.8, the impact includes total system compromise, potential inclusion of the device in a botnet, and the ability to pivot into the internal network from the compromised camera.

Immediate Action: Update the camera firmware to the latest available version provided by the manufacturer. If no patch is available, disable the DebugShell interface or isolate the device from all public-facing networks.

Proactive Monitoring: Inspect system logs for unexpected process execution or modifications to the device configuration.

Compensating Controls: Use a Web Application Firewall or network access control list to restrict access to TCP port 34567 to authorized administrative IP addresses only.

Public Exploit Available: No (exploit_available unknown).

The potential for root-level command execution makes this a high-priority risk. Administrators should immediately isolate affected devices from the internet and monitor for any unauthorized connections until a firmware update is applied.