Puwell IP Camera firmware versions 2.x through 4.x contains a critical authentication bypass vulnerability tracked as CVE-2026-61514. Unauthenticated attackers can exploit an unvalidated Session field in the proprietary control protocol header by sending protocol-conforming packets over TCP port 23456 without credentials. Successful exploitation allows attackers to access live video streams, control pan and tilt motors, activate audio functions, and remotely restart affected devices. The vulnerability affects a wide range of firmware versions, increasing the attack surface significantly. No authentication or special privileges are required to exploit this flaw, making it highly accessible to threat actors. The issue resides in the device's proprietary control protocol implementation, which fails to validate session credentials. This vulnerability poses significant privacy and physical security risks given the nature of IP camera devices. Patches or mitigations should be applied immediately to affected devices.