Read the docs
TI-2025-24190 Aliases CVE-2025-34021GHSA-x8w3-ggh8-5mqq

Selea Targa IP OCR-ANPR Camera Server-Side Request Forgery

Priority HIGH 67CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A server-side request forgery (SSRF) vulnerability exists in multiple Selea Targa IP OCR-ANPR camera models, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, and Targa 704 ILB. The application fails to validate user-supplied input in JSON POST parameters such as ipnotify_address and url, which are used by internal mechanisms to perform image fetch and DNS lookups. This allows remote unauthenticated attackers to induce the system to make arbitrary HTTP requests to internal or external systems, potentially bypassing firewall policies or conducting internal service enumeration. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-25 UTC.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00604 49th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SeleaTarga IP OCR-ANPR CameraBLD201113005214; BLD201106163745; BLD200304170901; BLD200304170514; BLD200303143345; BLD191118145435; BLD191021180140; CPS 4.013(201105); CPS 3.100(200225); CPS 3.005(191206); CPS 3.005(191112)—No fix listedCNA
  • Targa IP OCR-ANPR Camera VendorSelea Affected BLD201113005214; BLD201106163745; BLD200304170901; BLD200304170514; BLD200303143345; BLD191118145435; BLD191021180140; CPS 4.013(201105); CPS 3.100(200225); CPS 3.005(191206); CPS 3.005(191112) Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34021
  2. 2026-10-03 Alias added: GHSA-x8w3-ggh8-5mqq

References

Exploit 3

Other 1

  • TI-2021-22348 Selea Targa IP Camera Developer Backdoor Configuration Overwrite CVSS 4.0CRITICAL 9.3
  • TI-2021-22345 Selea Targa IP Camera Remote Code Execution via Utils CVSS 4.0CRITICAL 9.3
  • TI-2020-19039 Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint CVSS 4.0CRITICAL 9.3
  • TI-2021-22347 Selea Targa IP Camera Cross-Site Request Forgery via Admin Creation CVSS 4.0HIGH 8.5
  • TI-2021-22344 Selea Targa IP Camera Unauthenticated Stream Disclosure CVSS 4.0HIGH 8.7
  • TI-2025-24191 Selea Targa IP OCR-ANPR Camera Path Traversal CVSS 4.0CRITICAL 9.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences