What’s Vulnerable › Vulnerabilities

CVE-2021-47728: Selea Targa IP Camera Remote Code Execution via Utils

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-09 · updated 2026-06-17
• Weakness: CWE-78

Description

Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local file inclusion techniques.

Affected products

• Selea Carplateserver: 3.005(191112), 3.005(191206), 3.100(200225), 4.013(201105)
• Selea Izero Box Full Firmware: all versions
• Selea Izero Column Entry/8 Firmware: all versions
• Selea Izero Column Full/8 Firmware: all versions
• Selea Targa 504 Firmware: all versions
• Selea Targa 512 Firmware: all versions
• Selea Targa 704 Ilb Firmware: all versions
• Selea Targa 704 Tkm Firmware: all versions
• Selea Targa 710 Inox Firmware: all versions
• Selea Targa 750 Firmware: all versions
• Selea Targa 805 Firmware: all versions
• Selea Targa Semplice Firmware: all versions

References

• https://github.com/zeroscience
• https://www.exploit-db.com/exploits/49460
• https://www.selea.com
• https://www.vulncheck.com/advisories/selea-targa-ip-camera-remote-code-execution-via-utils
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5620.php

Get alerted when CVE-2021-47728 or the next vulnerability affects your stack