CVE-2021-47728

Selea Targa IP Camera Remote Code Execution via Utils

Critical9.3EPSS 2.6%

Published: 9 Dec 2025
Updated: 7 Apr 2026
Reserved: 7 Dec 2025
Assigned by: VulnCheck

Description

Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local file inclusion techniques.

Scores

CVSS scores of CVE-2021-47728, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 2.6% · top 14% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

Selea · Selea Targa IP OCR-ANPR Camera
- affected Unknown

References (5)

ExploitDB-49460 (opens in a new tab)exploit
Selea Homepage (opens in a new tab)product
Zero Science Lab Disclosure (ZSL-2021-5620) (opens in a new tab)third-party-advisory
Zero Science GitHub Repository (opens in a new tab)product
VulnCheck Advisory: Selea Targa IP Camera Remote Code Execution via Utils (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2021-47728](https://trackcve.app/badge/CVE-2021-47728.svg)](https://trackcve.app/cve/CVE-2021-47728)

Record last updated 7 Apr 2026, 14:05 UTC.