CVE-2021-47731 is a critical (CVSS 9.8) flaw in Selea Targa IP OCR-ANPR cameras. An undocumented page accepts a hard-coded developer password that enables configuration upload and lets an attacker overwrite device settings. No fixed firmware is confirmed, so check with Selea and isolate the devices.
What's affected
The same device family as CVE-2021-47728. The record lists Selea Targa 504, iZero Box Full, iZero Column Entry/8, iZero Column Full/8 and CarPlateServer. VulnCheck lists a wider set of Targa models and says no firmware version is defined.
The record says the camera has a hard-coded developer password on an undocumented page, and that using it enables configuration upload so device settings can be overwritten. The record publishes the password itself, which is why we do not repeat it here. The key point is that every unit shares the same secret, so it cannot be changed per device.
I could not confirm a fixed firmware.
How to check if you're exposed
Inventory the cameras first, with model and firmware. License plate readers are commonly installed by third parties, so ask who maintains them.
Then check where each device sits. From a management host you control:
nmap -sV -p 80,443,8080 <camera-address>
A hard-coded credential means that exposure to any network is exposure to everyone who knows it. Check for port forwards and cloud relays that publish the camera. Check whether the camera's configuration looks as expected: addresses, upload destinations and any settings you did not make.
Ask the vendor how to verify that the configuration has not been changed.
What to do now
- List all Selea Targa and iZero devices, with model and firmware.
- Ask Selea whether firmware removes the hard-coded access, and apply it when available.
- Block access to the devices from anything except a management network, and remove internet exposure.
- Compare the saved configuration with a known good copy, and restore a clean one if it has changed.
- Include these devices in your regular inventory review.
Why it matters
The record classes this under CWE-306 (Missing Authentication for Critical Function). A hard-coded password is a poor substitute for authentication: it is the same on every device, it cannot be rotated and anyone who learns it has the keys to every unit. Once published, as it is in public records, it is no secret at all.
Developer access left in production firmware is a recurring cause of device compromises. The remedy lies with the vendor: remove the access, or make it require a per-device secret. Customers can only reduce reach, by isolating the devices and limiting who can talk to them.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Can I change the hard-coded password?
The record describes it as hard-coded, so you cannot change it yourself. Only a vendor firmware change can remove it.
What is the best mitigation I control?
Isolate the cameras on a management network, remove internet exposure and restrict which hosts can reach the device.
Sources
Last reviewed: 19 October 2026.
