CVE-2021-47730
📋 TL;DR
Selea Targa IP OCR-ANPR cameras contain a CSRF vulnerability that allows attackers to create administrative accounts without authentication. When a logged-in user visits a malicious webpage, it can automatically submit a form to add a new admin user with full system privileges. This affects all users of vulnerable Selea Targa IP camera systems.
💻 Affected Systems
- Selea Targa IP OCR-ANPR Camera
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control of the camera system, allowing them to disable security features, manipulate video feeds, access sensitive data, or use the camera as an entry point into the network.
Likely Case
Unauthorized administrative accounts are created, leading to camera system compromise, surveillance disruption, and potential lateral movement into connected networks.
If Mitigated
With proper network segmentation and access controls, impact is limited to the camera system itself without network-wide compromise.
🎯 Exploit Status
Exploit requires a logged-in admin user to visit a malicious webpage. The exploit code is publicly available on Exploit-DB and GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with Selea for specific firmware versions
Vendor Advisory: https://www.selea.com
Restart Required: Yes
Instructions:
1. Contact Selea support for latest firmware. 2. Backup camera configuration. 3. Upload new firmware via web interface. 4. Reboot camera. 5. Verify fix by testing admin creation CSRF.
🔧 Temporary Workarounds
Network Segmentation
allIsolate camera network from user workstations and internet
Browser Security Extensions
allInstall CSRF protection browser extensions for admin users
🧯 If You Can't Patch
- Place cameras on isolated VLAN with no internet access
- Implement strict firewall rules to limit camera management interface access to specific IPs only
🔍 How to Verify
Check if Vulnerable:
Test by attempting CSRF attack on admin creation endpoint while logged in as adminCheck Version:
Check firmware version in camera web interface under System > InformationVerify Fix Applied:
Attempt CSRF attack after patch - should fail with proper CSRF token validation📡 Detection & Monitoring
Log Indicators:
- Unexpected admin user creation events
- Multiple failed login attempts followed by successful admin creation
Network Indicators:
- HTTP POST requests to admin creation endpoint from unexpected sources
- Cross-origin requests to camera management interface
SIEM Query:
source="camera_logs" AND (event="user_created" OR event="admin_added")