CVE-2021-47728

Selea Targa IP Camera Remote Code Execution via Utils

Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local file inclusion techniques.

Affected

Selea · Selea Targa IP OCR-ANPR Camera

CVSS v4.0 VULNCHECK

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.62% chance of exploitation in the next 30 days, 85th percentile

Published

2025-12-09

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/49460

Security advisories

• https://www.vulncheck.com/advisories/selea-targa-ip-camera-remote-code-execution-via-utils
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5620.php
• https://www.selea.com

References

• CVE Record
• NVD entry