CVE-2021-47728
Selea Targa IP Camera Remote Code Execution via Utils
- State
- Published
- Severity
- 9.3 Critical
- Published
- Dec 9, 2025
- Updated
- Apr 7, 2026
- Reserved
- Dec 7, 2025
Description
Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local file inclusion techniques.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
Selea Targa IP OCR-ANPR CameraSelea |
|
References
- ExploitDB-49460exploit
- Selea Homepageproduct
- Zero Science Lab Disclosure (ZSL-2021-5620)third-party-advisory
- Zero Science GitHub Repositoryproduct
- VulnCheck Advisory: Selea Targa IP Camera Remote Code Execution via Utilsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.