CVE-2021-47728
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary shell commands on Selea Targa IP OCR-ANPR cameras without authentication. Attackers can exploit command injection in the utils.php file to gain www-data user access and potentially full system control. Organizations using these cameras in security or surveillance systems are affected.
💻 Affected Systems
- Selea Targa IP OCR-ANPR Camera
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install persistent backdoors, exfiltrate surveillance footage, pivot to internal networks, or disable security systems entirely.
Likely Case
Attackers gain www-data user access to execute commands, potentially accessing camera feeds, modifying configurations, or using the device as a foothold for further attacks.
If Mitigated
If properly segmented and monitored, impact limited to isolated camera system with no network access to critical assets.
🎯 Exploit Status
Public exploit code available on Exploit-DB (ID 49460) with working proof-of-concept; exploitation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.selea.com
Restart Required: No
Instructions:
Check Selea website for security advisories and firmware updates. If available, download latest firmware and follow vendor update procedures.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras in separate VLAN with strict firewall rules blocking all inbound internet access and limiting internal communication.
Web Interface Restriction
allBlock access to camera web interface from untrusted networks using firewall rules or reverse proxy with authentication.
🧯 If You Can't Patch
- Immediately remove cameras from internet exposure and place behind strict firewall with only necessary outbound connectivity
- Implement network monitoring for unusual outbound connections or command execution patterns from camera IPs
🔍 How to Verify
Check if Vulnerable:
Check if camera responds to exploitation attempts targeting /utils.php with addr/port parameter injection, or review firmware version against vendor advisories.Check Version:
Check firmware version via camera web interface under System > Information or similar menuVerify Fix Applied:
Test exploitation attempts after applying vendor patches; successful exploitation should no longer work.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to utils.php with shell metacharacters in parameters
- Command execution patterns in system logs
- Unexpected processes running as www-data
Network Indicators:
- Outbound connections from camera to unexpected destinations
- Unusual traffic patterns from camera IP
SIEM Query:
source="camera_logs" AND (url="/utils.php" AND (param="addr" OR param="port") AND value MATCHES "[;|&`$()]"))