Puwell IP Camera firmware versions 2.x through 4.x contains a critical unauthenticated command injection vulnerability tracked as CVE-2026-61515. Remote attackers can exploit the DebugShell interface exposed on TCP port 34567 by sending a crafted JSON payload. The vulnerability stems from a complete lack of authentication and input sanitization in the binary protocol service. Successful exploitation allows attackers to pass arbitrary commands directly to the underlying operating system. This results in root-level code execution and complete device compromise. No authentication is required, making this trivially exploitable by remote unauthenticated attackers. The affected firmware spans multiple major versions, indicating a wide attack surface across deployed devices.