CVE-2021-47728

Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local file inclusion techniques.

CVSS v4.0

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.65% chance of exploitation in the next 30 days, 85th percentile

Published

2025-12-09

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/49460

References

• CVE Record
• NVD entry

Related

• CVE-2021-47727
• CVE-2021-47729
• CVE-2021-47726
• CVE-2021-47730
• CVE-2021-47725
• CVE-2021-47731