CVE-2021-47728 Selea Targa IP Camera Remote Code Execution via Utils

Critical 9.3 Published 9 Dec 2025 Updated 7 Apr 2026

Remote attackers can execute arbitrary shell commands on Selea Targa IP cameras via unauthenticated command injection in utils.php.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-47728?

CVE-2021-47728 is a critical command injection vulnerability in Selea Targa IP OCR-ANPR Camera, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local file inclusion techniques.

Weakness: CWE-78

Which versions are affected by CVE-2021-47728?

It affects 12 products.

Products include Selea Carplateserver, Selea Izero Box Full Firmware, Selea Izero Column Entry\/8 Firmware, Selea Izero Column Full\/8 Firmware, Selea Targa 504 Firmware, Selea Targa 512 Firmware and 6 more.

How do I fix CVE-2021-47728?

No fix has been published for CVE-2021-47728 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2021-47728 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47728 exists.

Sources

Also known as GHSA-mx39-grv7-hq6w.