CVE-2021-47728 is a critical (CVSS 9.8) unauthenticated command injection in Selea Targa IP OCR-ANPR cameras. The addr and port parameters in utils.php reach a shell, and chained local file inclusion gives access as the www-data user. No fixed firmware is confirmed, so check with Selea.
What's affected
The record lists Selea Targa 504 and the related iZero Box Full, iZero Column Entry/8 and iZero Column Full/8 devices, plus CarPlateServer. VulnCheck's advisory lists a wider model set that includes iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805 and Targa 710 INOX, and notes that no version is defined.
The record says the unauthenticated command injection is in utils.php and that attackers can use the addr and port parameters to inject shell commands and gain access as the www-data user through chained local file inclusion.
I could not confirm a fixed firmware. Selea's website is linked in the record. Ask the vendor which firmware addresses this CVE and its sibling CVE-2021-47731.
How to check if you're exposed
Identify the cameras. License plate readers are often installed by contractors, so ask your facilities or parking teams for a list. For each unit, note the model and firmware from its web interface.
Find the devices on your network:
nmap -sV -p 80,443,8080 --open 192.168.0.0/24
Only scan networks you manage. Check whether any camera is reachable from outside the site, through port forwarding or a cloud relay, and whether it shares a network with business systems.
Review any access logs the device keeps for requests to utils.php from unfamiliar addresses.
What to do now
- Build a list of Selea Targa and iZero devices with model and firmware.
- Contact Selea for firmware that addresses this CVE and CVE-2021-47731, and apply it.
- Put the cameras on an isolated network segment and remove any internet exposure.
- Restrict the device web interface to named management addresses.
- Treat a device that was exposed as potentially compromised. Reset it and review the systems it can reach.
Why it matters
The class is CWE-78 (OS Command Injection). A utility page takes an address and a port and passes them to a shell command, presumably to test a connection. Without strict validation, special characters in those values end one command and start another.
The record also mentions chained local file inclusion, a second step that helps an attacker move from one weakness to code running on the device. Chains like this are why a single medium issue can matter more than its score suggests.
License plate readers collect data about vehicles and people. A compromised unit can expose that data and also act as a foothold on the network. The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Which Selea devices are affected?
The record lists Targa 504, iZero Box Full, iZero Column Entry/8, iZero Column Full/8 and CarPlateServer. VulnCheck lists more Targa models. Check with Selea.
Is it related to CVE-2021-47731?
They affect the same device family. This one is command injection. The other is a hard-coded developer password.
Sources
Last reviewed: 19 October 2026.
