CVE-2021-47727 Selea Targa IP Camera Unauthenticated Stream Disclosure
Remote attackers can access live video streams from Selea Targa IP cameras without authentication by requesting specific endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47727?
CVE-2021-47727 is a high-severity missing authorization vulnerability in Selea Targa IP OCR-ANPR Camera, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Selea Targa IP OCR-ANPR Camera contains an unauthenticated vulnerability that allows remote attackers to access live video streams without authentication. Attackers can directly connect to RTP/RTSP or M-JPEG streams by requesting specific endpoints like p1.mjpg or p1.264 to view camera footage.
Weakness: CWE-306
Which versions are affected by CVE-2021-47727?
It affects 12 products.
Products include Selea Carplateserver, Selea Izero Box Full Firmware, Selea Izero Column Entry\/8 Firmware, Selea Izero Column Full\/8 Firmware, Selea Targa 504 Firmware, Selea Targa 512 Firmware and 6 more.
How do I fix CVE-2021-47727?
No fix has been published for CVE-2021-47727 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-47727 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47727 exists.
Other vulnerabilities in Selea Targa IP OCR-ANPR Camera
- CVE-2021-47728 Selea Targa IP Camera Remote Code Execution via Utils
- CVE-2021-47731 Selea Targa IP Camera Developer Backdoor Configuration Overwrite
- CVE-2021-47730 Selea Targa IP Camera Cross-Site Request Forgery via Admin Creation
- CVE-2021-47729 Selea Targa IP Camera Stored Cross-Site Scripting via Files List
Sources
Also known as GHSA-mrj4-3c4j-jh3r.