CVE-2021-47728
Published: 09 December 2025
Description
Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained…
more
local file inclusion techniques.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation and sanitization of untrusted inputs like the 'addr' and 'port' parameters in utils.php.
Requires identification and authentication for non-organizational users, blocking unauthenticated remote exploitation of the vulnerability.
Limits permitted actions without identification or authentication, preventing exposure of the vulnerable utils.php endpoint to unauthorized remote attackers.
Security SummaryAI
CVE-2021-47728 is an unauthenticated command injection vulnerability (CWE-78) affecting the Selea Targa IP OCR-ANPR Camera, specifically in the utils.php component. Remote attackers can exploit the 'addr' and 'port' parameters to inject and execute arbitrary shell commands, leveraging chained local file inclusion techniques to gain access as the www-data user. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and lack of prerequisites.
Any remote attacker can exploit this vulnerability without authentication, requiring no privileges, user interaction, or special conditions. Successful exploitation allows execution of arbitrary shell commands on the device, potentially leading to full compromise including high confidentiality, integrity, and availability impacts as reflected in the CVSS score.
Advisories and references, including those from Zeroscience (ZSL-2021-5620), Vulncheck, and Exploit-DB (exploit 49460), provide technical details and a proof-of-concept, while the vendor site at Selea.com is listed for potential updates. No specific patch or mitigation details are outlined in the available information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote command injection in a public-facing web application (IP camera utils.php) directly enables T1190 for initial access and T1059.004 for arbitrary Unix shell command execution as www-data.