Security readout for executives and security teams
Plain-English summary
CVE-2021-47728 is a critical unauthenticated command injection issue in Selea Targa IP OCR-ANPR cameras. A remote attacker could run operating-system commands as the web server user. This matters most where these cameras are reachable from untrusted networks or the internet.
Executive priority
Treat this as urgent for any exposed Selea Targa camera. Prioritize discovery and isolation first, because the sources do not name a patched version. If no devices are deployed, business impact is likely low.
Technical view
The issue is CWE-78 command injection in utils.php. The provided advisory states the addr and port parameters can be abused to execute shell commands, with access as www-data through chained local file inclusion techniques. CVSS 4.0 is 9.3, network reachable, low complexity, no privileges, and no user interaction.
Likely exposure
Exposure is likely limited to organizations operating Selea Targa IP OCR-ANPR cameras, especially if their web interface is internet-accessible or reachable from broad internal networks. Affected versions are not specified in the provided sources.
Exploitation context
A public ExploitDB reference exists, but the CVE is not listed as KEV in the provided bundle. There is no cited evidence of active exploitation. Public exploit availability still increases urgency for exposed devices.
Researcher notes
The sources identify the vulnerable component and parameters, but affected version ranges and vendor remediation details are incomplete. Avoid assuming all Selea products are affected. Public exploit availability is documented, but active exploitation is not established by the provided sources.
Mitigation direction
- Identify all Selea Targa IP OCR-ANPR cameras in the environment.
- Remove camera web interfaces from direct internet exposure.
- Restrict access to trusted management networks or VPNs only.
- Check Selea or integrator guidance for fixed firmware or configuration mitigations.
- Monitor for suspicious access to utils.php and unusual addr or port parameter activity.
Validation and detection
- Confirm whether any Selea Targa IP OCR-ANPR cameras are deployed.
- Review asset inventories, network scans, and procurement records for Selea devices.
- Determine whether camera management interfaces are internet-facing.
- Review web logs for abnormal utils.php requests or command-like parameter values.
- Verify firmware status and remediation options with Selea or the system integrator.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-47728 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-49460CVE reference · exploit
- Selea HomepageCVE reference · product
- Zero Science Lab Disclosure (ZSL-2021-5620)CVE reference · third-party-advisory
- Zero Science GitHub RepositoryCVE reference · product
- VulnCheck Advisory: Selea Targa IP Camera Remote Code Execution via UtilsCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.