VulnerabilityModified

CVE-2021-47730

Selea Targa IP OCR-ANPR Camera contains a cross-site request forgery vulnerability that allows attackers to create administrative users without authentication.

HIGH 8.5EPSS 0.25%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.25%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Selea Targa IP OCR-ANPR Camera contains a cross-site request forgery vulnerability that allows attackers to create administrative users without authentication. Attackers can craft a malicious web page that submits a form to add a new admin user with full system privileges when a logged-in user visits the page.

CVSS 4.0: 8.5 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.25% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: selea/izero box full firmware · selea/izero column entry\/8 firmware · selea/izero column full\/8 firmware · selea/targa 504 firmware · selea/targa 512 firmware · selea/targa 704 ilb firmware · selea/targa 704 tkm firmware · selea/targa 710 inox firmware · selea/targa 750 firmware · selea/targa 805 firmware · selea/targa semplice firmware · selea/carplateserver
Source: disclosure@vulncheck.com

References

https://github.com/zeroscienceNot Applicable
https://www.exploit-db.com/exploits/49458Exploit
https://www.selea.comProduct
https://www.vulncheck.com/advisories/selea-targa-ip-camera-cross-site-request-forgery-via-admin-creationThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5618.phpThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.