CVE-2021-47728

CRITICAL

9.8

Description

Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local file inclusion techniques.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published12/9/2025

Last Modified2/23/2026

Sourcenvd

Honeypot Sightings0

Affected Products

selea:carplateserverselea:izero_box_fullselea:izero_box_full_firmwareselea:izero_column_entry\/8selea:izero_column_entry\/8_firmwareselea:izero_column_full\/8selea:izero_column_full\/8_firmwareselea:targa_504selea:targa_504_firmwareselea:targa_512selea:targa_512_firmwareselea:targa_704_ilbselea:targa_704_ilb_firmwareselea:targa_704_tkmselea:targa_704_tkm_firmwareselea:targa_710_inoxselea:targa_710_inox_firmwareselea:targa_750selea:targa_750_firmwareselea:targa_805selea:targa_805_firmwareselea:targa_sempliceselea:targa_semplice_firmware

Weaknesses (CWE)

CWE-78

References

https://github.com/zeroscience(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/49460(disclosure@vulncheck.com)

https://www.selea.com(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/selea-targa-ip-camera-remote-code-execution-via-utils(disclosure@vulncheck.com)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5620.php(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.