by Kastro
Paper/Archive/CVE-2021-47728

CVE-2021-47728

Selea Selea Targa IP OCR-ANPR Camera — Selea Targa IP Camera Remote Code Execution via Utils

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.4.854 × 2017.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local file inclusion techniques.

Affected

ProductAffectedFixed inSource
Selea Targa IP OCR-ANPR CameraUnknown–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/49460refselea.comwriteupzeroscience.mk/en/vulnerabilities/ZSL-2021-5620.phprefgithub.com/zerosciencewriteupvulncheck.com/advisories/selea-targa-ip-camera-remote-code-execution-via-utils