CVE-2021-47727
📋 TL;DR
Selea Targa IP OCR-ANPR cameras contain an unauthenticated vulnerability that allows remote attackers to access live video streams without authentication. Attackers can directly connect to RTP/RTSP or M-JPEG streams by requesting specific endpoints to view camera footage. This affects organizations using these cameras for surveillance or ANPR systems.
💻 Affected Systems
- Selea Targa IP OCR-ANPR Camera
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of video surveillance privacy, enabling attackers to monitor sensitive areas, track individuals/vehicles, and potentially use footage for reconnaissance before physical attacks.
Likely Case
Unauthorized viewing of camera feeds, compromising privacy and security monitoring, potentially exposing sensitive operations or personal information.
If Mitigated
Limited to authenticated users only, maintaining proper access controls and surveillance integrity.
🎯 Exploit Status
Exploit requires only HTTP requests to specific endpoints (p1.mjpg, p1.264) without authentication; trivial to automate.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.selea.com
Restart Required: No
Instructions:
Check vendor website for firmware updates; if unavailable, apply workarounds immediately.
🔧 Temporary Workarounds
Network Segmentation
allPlace cameras on isolated VLANs with strict firewall rules blocking external access to camera ports.
Access Control Lists
allConfigure firewall/network devices to allow camera access only from authorized management IPs.
🧯 If You Can't Patch
- Disable camera internet exposure and restrict to internal networks only.
- Implement VPN for remote access instead of direct camera exposure.
🔍 How to Verify
Check if Vulnerable:
Attempt HTTP GET requests to camera IP on common ports (e.g., 80, 554) for endpoints like /p1.mjpg or /p1.264; if video streams without authentication, vulnerable.Check Version:
Check camera web interface or firmware settings for version info; vendor-specific.Verify Fix Applied:
Repeat check; streams should require authentication or return error/denial.📡 Detection & Monitoring
Log Indicators:
- Unusual access to video stream endpoints from unauthorized IPs
- Failed authentication attempts followed by stream access
Network Indicators:
- RTP/RTSP/M-JPEG traffic from cameras to unexpected external IPs
- HTTP requests to p1.mjpg/p1.264 without prior auth
SIEM Query:
source_ip=* dest_ip=camera_ip (http_uri="/p1.mjpg" OR http_uri="/p1.264") AND NOT user_authenticated=true