CVE-2021-47728: Selea Carplateserver

Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days.

Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local file inclusion techniques.

Affected products

• Selea Carplateserver: version 3.005(191112) only; version 3.005(191206) only; version 3.100(200225) only; version 4.013(201105) only
• Selea Izero Box Full Firmware: affected versions not specified
• Selea Izero Column entry/8 Firmware: affected versions not specified
• Selea Izero Column full/8 Firmware: affected versions not specified
• Selea Targa 504 Firmware: affected versions not specified
• Selea Targa 512 Firmware: affected versions not specified
• Selea Targa 704 Ilb Firmware: affected versions not specified
• Selea Targa 704 Tkm Firmware: affected versions not specified
• Selea Targa 710 Inox Firmware: affected versions not specified
• Selea Targa 750 Firmware: affected versions not specified
• Selea Targa 805 Firmware: affected versions not specified
• Selea Targa Semplice Firmware: affected versions not specified

Published 2025-12-09. Last modified 2026-06-17.