Read the docs
TI-2025-24191 Aliases CVE-2025-34022GHSA-8gmg-2fm9-487f

Selea Targa IP OCR-ANPR Camera Path Traversal

Priority HIGH 73CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

A path traversal vulnerability exists in multiple models of Selea Targa IP OCR-ANPR cameras, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, and Targa 704 ILB. The /common/get_file.php script in the “Download Archive in Storage” page fails to properly validate user-supplied input to the file parameter. Unauthenticated remote attackers can exploit this vulnerability to read arbitrary files on the device, including sensitive system files containing cleartext credentials, potentially leading to authentication bypass and exposure of system information. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00794 56th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SeleaTarga IP OCR-ANPR CameraBLD201113005214; BLD201106163745; BLD200304170901; BLD200304170514; BLD200303143345; BLD191118145435; BLD191021180140; CPS 4.013(201105); CPS 3.100(200225); CPS 3.005(191206); CPS 3.005(191112)—No fix listedCNA
  • Targa IP OCR-ANPR Camera VendorSelea Affected BLD201113005214; BLD201106163745; BLD200304170901; BLD200304170514; BLD200303143345; BLD191118145435; BLD191021180140; CPS 4.013(201105); CPS 3.100(200225); CPS 3.005(191206); CPS 3.005(191112) Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34022
  2. 2026-10-03 Alias added: GHSA-8gmg-2fm9-487f

References

Exploit 3

Other 1

  • TI-2021-22348 Selea Targa IP Camera Developer Backdoor Configuration Overwrite CVSS 4.0CRITICAL 9.3
  • TI-2021-22345 Selea Targa IP Camera Remote Code Execution via Utils CVSS 4.0CRITICAL 9.3
  • TI-2020-19039 Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint CVSS 4.0CRITICAL 9.3
  • TI-2021-22347 Selea Targa IP Camera Cross-Site Request Forgery via Admin Creation CVSS 4.0HIGH 8.5
  • TI-2021-22344 Selea Targa IP Camera Unauthenticated Stream Disclosure CVSS 4.0HIGH 8.7
  • TI-2020-19038 Selea CarPlateServer 4.0.1.6 Local Privilege Escalation via Unquoted Service Path CVSS 4.0HIGH 8.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences