CVEvulnerability

CVE-2021-47728

9.3 CRITICAL Published 2025-12-09 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-12-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78

Description

Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local file inclusion techniques.

Affected configurations

• selea izero box full firmware • selea izero column entry\/8 firmware • selea izero column full\/8 firmware • selea targa 504 firmware • selea targa 512 firmware • selea targa 704 ilb firmware • selea targa 704 tkm firmware • selea targa 710 inox firmware • selea targa 750 firmware • selea targa 805 firmware • selea targa semplice firmware • selea carplateserver 3.005\(191112\) • selea carplateserver 3.005\(191206\) • selea carplateserver 3.100\(200225\) • selea carplateserver 4.013\(201105\)

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References